@aws/agentcore 1.0.0-preview.21 → 1.0.0-preview.23

package/dist/lib/dependency-management/index.d.ts

@@ -0,0 +1,5 @@
+export { syncManagedDependencies } from './sync';
+export { computeSyncPlan } from './plan';
+export type { SkewFinding, SyncPlan } from './plan';
+export type { DependencyChange, DependencySyncOutcome, DependencySyncResult, PackageManifest, RestoredDependency, SkippedDependency, SyncManagedDependenciesOptions, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/dependency-management/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACpD,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,SAAS,CAAC"}

package/dist/lib/dependency-management/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSyncPlan = exports.syncManagedDependencies = void 0;
+var sync_1 = require("./sync");
+Object.defineProperty(exports, "syncManagedDependencies", { enumerable: true, get: function () { return sync_1.syncManagedDependencies; } });
+var plan_1 = require("./plan");
+Object.defineProperty(exports, "computeSyncPlan", { enumerable: true, get: function () { return plan_1.computeSyncPlan; } });
+//# sourceMappingURL=index.js.map

package/dist/lib/dependency-management/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/index.ts"],"names":[],"mappings":";;;AAAA,+BAAiD;AAAxC,+GAAA,uBAAuB,OAAA;AAChC,+BAAyC;AAAhC,uGAAA,eAAe,OAAA"}

package/dist/lib/dependency-management/messages.d.ts

@@ -0,0 +1,30 @@
+import type { SkewFinding } from './plan';
+import type { DependencyChange, RestoredDependency, SkippedDependency } from './types';
+/**
+ * Single source of user-facing wording for dependency management, so the
+ * headless and TUI deploy paths (and any future CLI) can't drift apart.
+ */
+/**
+ * Fallback CLI install command when the caller doesn't thread one in. The CLI layer
+ * passes `getDistroConfig().installCommand` (dist-tag/registry aware); this default
+ * keeps the lib module usable standalone.
+ */
+export declare const DEFAULT_CLI_INSTALL_COMMAND = "npm install -g @aws/agentcore@latest";
+export declare const OPT_OUT_HINT = "To manage these versions yourself: agentcore config disableDependencyManagement true";
+/**
+ * Error text for newer-than-CLI skew. Names the skewed dependencies, gives the
+ * distro-correct upgrade command, and — because the skew may be a deliberate manual
+ * bump rather than a newer CLI — points at the opt-out as the alternative.
+ */
+export declare function formatCliUpgradeError(skew: SkewFinding[], installCommand: string): string;
+export declare function formatSyncNotice(options: {
+    migratedFromCaret: boolean;
+    changes: DependencyChange[];
+    restored: RestoredDependency[];
+    reinstalled: boolean;
+    /** False in check mode — nothing was written, so speak in the future tense. */
+    applied: boolean;
+}): string | null;
+export declare function formatSkewWarning(skew: SkewFinding[], installCommand: string): string;
+export declare function formatSkippedWarning(skipped: SkippedDependency): string;
+//# sourceMappingURL=messages.d.ts.map

package/dist/lib/dependency-management/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/messages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEvF;;;GAGG;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,yCAAyC,CAAC;AAElF,eAAO,MAAM,YAAY,yFAAyF,CAAC;AAiBnH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAUzF;AAYD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,MAAM,GAAG,IAAI,CA6BhB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKrF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEvE"}

package/dist/lib/dependency-management/messages.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPT_OUT_HINT = exports.DEFAULT_CLI_INSTALL_COMMAND = void 0;
+exports.formatCliUpgradeError = formatCliUpgradeError;
+exports.formatSyncNotice = formatSyncNotice;
+exports.formatSkewWarning = formatSkewWarning;
+exports.formatSkippedWarning = formatSkippedWarning;
+/**
+ * Single source of user-facing wording for dependency management, so the
+ * headless and TUI deploy paths (and any future CLI) can't drift apart.
+ */
+/**
+ * Fallback CLI install command when the caller doesn't thread one in. The CLI layer
+ * passes `getDistroConfig().installCommand` (dist-tag/registry aware); this default
+ * keeps the lib module usable standalone.
+ */
+exports.DEFAULT_CLI_INSTALL_COMMAND = 'npm install -g @aws/agentcore@latest';
+exports.OPT_OUT_HINT = 'To manage these versions yourself: agentcore config disableDependencyManagement true';
+const MIGRATION_PREAMBLE = 'Your project was created before the AgentCore CLI managed dependency versions.\n' +
+    "We've updated agentcore/cdk/package.json so the CLI keeps these dependencies\n" +
+    'on versions it has been tested with (patch updates still apply automatically):';
+// Check-mode variant: nothing was written, so the wording must promise rather than claim.
+const MIGRATION_PREAMBLE_PENDING = 'Your project was created before the AgentCore CLI managed dependency versions.\n' +
+    'agentcore/cdk/package.json will be updated on the next deploy so the CLI keeps these\n' +
+    'dependencies on versions it has been tested with (patch updates still apply automatically):';
+function formatSkewList(skew) {
+    return skew.map(s => `${s.name} (${s.declared}, CLI expects ${s.expected})`).join(', ');
+}
+/**
+ * Error text for newer-than-CLI skew. Names the skewed dependencies, gives the
+ * distro-correct upgrade command, and — because the skew may be a deliberate manual
+ * bump rather than a newer CLI — points at the opt-out as the alternative.
+ */
+function formatCliUpgradeError(skew, installCommand) {
+    const plural = skew.length > 1;
+    return (`This project requires a newer version of the AgentCore CLI: ${formatSkewList(skew)} ` +
+        `${plural ? 'are' : 'is'} newer than this CLI was tested with. ` +
+        `Run \`${installCommand}\` and retry.\n` +
+        `If you intentionally updated ${plural ? 'these dependencies' : 'this dependency'} yourself, ` +
+        'you can disable managed dependency versions instead:\n' +
+        exports.OPT_OUT_HINT);
+}
+function formatChangeTable(changes, restored) {
+    const rows = [
+        ...changes.map(c => ({ name: c.name, from: c.from, to: c.to })),
+        ...restored.map(r => ({ name: r.name, from: '(removed)', to: r.to })),
+    ];
+    const nameWidth = Math.max(...rows.map(r => r.name.length));
+    const fromWidth = Math.max(...rows.map(r => r.from.length));
+    return rows.map(r => `  ${r.name.padEnd(nameWidth)}  ${r.from.padEnd(fromWidth)} → ${r.to}`).join('\n');
+}
+function formatSyncNotice(options) {
+    const { migratedFromCaret, changes, restored, reinstalled, applied } = options;
+    if (changes.length === 0 && restored.length === 0)
+        return null;
+    const lines = [];
+    if (migratedFromCaret) {
+        lines.push(applied ? MIGRATION_PREAMBLE : MIGRATION_PREAMBLE_PENDING);
+    }
+    else {
+        lines.push(applied
+            ? 'Updated managed dependencies in agentcore/cdk/package.json:'
+            : 'Managed dependencies in agentcore/cdk/package.json will be updated on the next deploy:');
+    }
+    lines.push('');
+    lines.push(formatChangeTable(changes, restored));
+    lines.push('');
+    if (reinstalled) {
+        lines.push('Ran npm install in agentcore/cdk to apply the updates.');
+    }
+    lines.push(applied
+        ? 'Dependencies you added yourself were not changed.'
+        : 'Dependencies you added yourself will not be changed.');
+    if (migratedFromCaret) {
+        lines.push(exports.OPT_OUT_HINT);
+    }
+    return lines.join('\n');
+}
+function formatSkewWarning(skew, installCommand) {
+    return (`${formatSkewList(skew)} ${skew.length === 1 ? 'is' : 'are'} newer than this CLI was tested with; ` +
+        `deploy may fail — upgrade the CLI with \`${installCommand}\`. ${exports.OPT_OUT_HINT}`);
+}
+function formatSkippedWarning(skipped) {
+    return `${skipped.name} (${skipped.raw}) ${skipped.reason}.`;
+}
+//# sourceMappingURL=messages.js.map

package/dist/lib/dependency-management/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/messages.ts"],"names":[],"mappings":";;;AAqCA,sDAUC;AAYD,4CAoCC;AAED,8CAKC;AAED,oDAEC;AAvGD;;;GAGG;AAEH;;;;GAIG;AACU,QAAA,2BAA2B,GAAG,sCAAsC,CAAC;AAErE,QAAA,YAAY,GAAG,sFAAsF,CAAC;AAEnH,MAAM,kBAAkB,GACtB,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF,CAAC;AAEnF,0FAA0F;AAC1F,MAAM,0BAA0B,GAC9B,kFAAkF;IAClF,wFAAwF;IACxF,6FAA6F,CAAC;AAEhG,SAAS,cAAc,CAAC,IAAmB;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,iBAAiB,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAAmB,EAAE,cAAsB;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,+DAA+D,cAAc,CAAC,IAAI,CAAC,GAAG;QACtF,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,wCAAwC;QAChE,SAAS,cAAc,iBAAiB;QACxC,gCAAgC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,aAAa;QAC9F,wDAAwD;QACxD,oBAAY,CACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA2B,EAAE,QAA8B;IACpF,MAAM,IAAI,GAAiD;QACzD,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACtE,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAOhC;IACC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,OAAO;YACL,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,wFAAwF,CAC7F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,OAAO;QACL,CAAC,CAAC,mDAAmD;QACrD,CAAC,CAAC,sDAAsD,CAC3D,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,oBAAY,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAmB,EAAE,cAAsB;IAC3E,OAAO,CACL,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,wCAAwC;QACnG,4CAA4C,cAAc,OAAO,oBAAY,EAAE,CAChF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAA0B;IAC7D,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;AAC/D,CAAC"}

package/dist/lib/dependency-management/plan.d.ts

@@ -0,0 +1,25 @@
+import type { DependencyChange, PackageManifest, RestoredDependency, SkippedDependency } from './types';
+/**
+ * Pure policy computation for managed-dependency syncing. No I/O.
+ *
+ * A dependency is "managed" iff its name appears in the vended manifest
+ * (dependencies or devDependencies). The vended specifier is authoritative:
+ * the sync copies it verbatim, so the pinning policy (tilde for stable deps,
+ * exact for L3 constructs) lives entirely in the vended asset.
+ */
+export interface SkewFinding {
+    name: string;
+    declared: string;
+    expected: string;
+}
+export interface SyncPlan {
+    /** Managed deps where the project declares a newer minor/major than the CLI expects. */
+    skew: SkewFinding[];
+    changes: DependencyChange[];
+    restored: RestoredDependency[];
+    skipped: SkippedDependency[];
+    /** True when any managed dep had a caret range — the project predates pinning. */
+    migratedFromCaret: boolean;
+}
+export declare function computeSyncPlan(vended: PackageManifest, project: PackageManifest): SyncPlan;
+//# sourceMappingURL=plan.d.ts.map

package/dist/lib/dependency-management/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/plan.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAEhB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAGjB;;;;;;;GAOG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,wFAAwF;IACxF,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kFAAkF;IAClF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AA2BD,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,GAAG,QAAQ,CAuC3F"}

package/dist/lib/dependency-management/plan.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSyncPlan = computeSyncPlan;
+const semver_1 = require("./semver");
+const semver_2 = require("semver");
+const SECTIONS = ['dependencies', 'devDependencies'];
+function findDeclared(manifest, name) {
+    for (const section of SECTIONS) {
+        const raw = manifest[section]?.[name];
+        if (raw !== undefined)
+            return { section, raw };
+    }
+    return null;
+}
+/**
+ * Skew exists when the project's declared base version is ahead of the CLI's
+ * expectation in a way patch-floating can't explain: a higher major.minor for
+ * ranged deps, or any prerelease-aware greater-than for exact pins (so an
+ * alpha.20 project is never silently downgraded to an alpha.19 CLI's pin).
+ */
+function isSkewed(declared, expected) {
+    if (declared.kind === 'unsupported' || expected.kind === 'unsupported')
+        return false;
+    const d = declared.version;
+    const e = expected.version;
+    if (expected.kind === 'exact')
+        return (0, semver_2.compare)(d, e) > 0;
+    if (d.major !== e.major)
+        return d.major > e.major;
+    return d.minor > e.minor;
+}
+function computeSyncPlan(vended, project) {
+    const plan = { skew: [], changes: [], restored: [], skipped: [], migratedFromCaret: false };
+    for (const section of SECTIONS) {
+        for (const [name, expectedRaw] of Object.entries(vended[section] ?? {})) {
+            const expected = (0, semver_1.parseSpecifier)(expectedRaw);
+            const declared = findDeclared(project, name);
+            if (!declared) {
+                // Managed dep deleted by the user — the vended CDK app can't build without it.
+                plan.restored.push({ name, section, to: expectedRaw });
+                continue;
+            }
+            if (declared.raw === expectedRaw)
+                continue;
+            const declaredSpec = (0, semver_1.parseSpecifier)(declared.raw);
+            if (declaredSpec.kind === 'unsupported') {
+                // file:/git:/tag/range specifiers (incl. the bundled-tarball override) are
+                // deliberate local overrides — never rewrite, never skew-check.
+                plan.skipped.push({
+                    name,
+                    raw: declared.raw,
+                    reason: 'uses a non-semver specifier and was left unmanaged',
+                });
+                continue;
+            }
+            if (isSkewed(declaredSpec, expected)) {
+                plan.skew.push({ name, declared: declared.raw, expected: expectedRaw });
+                continue;
+            }
+            if (declaredSpec.kind === 'caret')
+                plan.migratedFromCaret = true;
+            plan.changes.push({ name, section: declared.section, from: declared.raw, to: expectedRaw });
+        }
+    }
+    return plan;
+}
+//# sourceMappingURL=plan.js.map

package/dist/lib/dependency-management/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/plan.ts"],"names":[],"mappings":";;AA6DA,0CAuCC;AApGD,qCAA0C;AAS1C,mCAAiC;AA2BjC,MAAM,QAAQ,GAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,QAAyB,EAAE,IAAY;IAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,QAAyB;IACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAA,gBAAO,EAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED,SAAgB,eAAe,CAAC,MAAuB,EAAE,OAAwB;IAC/E,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAEtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,IAAA,uBAAc,EAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,+EAA+E;gBAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW;gBAAE,SAAS;YAE3C,MAAM,YAAY,GAAG,IAAA,uBAAc,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,YAAY,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACxC,2EAA2E;gBAC3E,gEAAgE;gBAChE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAChB,IAAI;oBACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;oBACjB,MAAM,EAAE,oDAAoD;iBAC7D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/dependency-management/semver.d.ts

@@ -0,0 +1,21 @@
+import type { SemVer } from 'semver';
+/** A parsed version: node-semver's SemVer (major / minor / patch / prerelease). */
+export type ParsedVersion = SemVer;
+export type SpecifierKind = 'exact' | 'tilde' | 'caret';
+export type ParsedSpecifier = {
+    kind: SpecifierKind;
+    version: ParsedVersion;
+    raw: string;
+} | {
+    kind: 'unsupported';
+    raw: string;
+};
+export declare function parseVersion(version: string): ParsedVersion | null;
+/**
+ * Parse an npm dependency specifier into exact / tilde / caret + base version.
+ * Anything else (file:, git:, workspace:, URLs, wildcards, compound ranges, tags)
+ * is 'unsupported' — the sync skips those rather than guessing. Strict parsing
+ * (no loose/coerce) keeps `1.x`, `*`, `latest`, and `>=1.2.3` unsupported.
+ */
+export declare function parseSpecifier(raw: string): ParsedSpecifier;
+//# sourceMappingURL=semver.d.ts.map

package/dist/lib/dependency-management/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/semver.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAKlE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAkB3D"}

package/dist/lib/dependency-management/semver.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseVersion = parseVersion;
+exports.parseSpecifier = parseSpecifier;
+/**
+ * Semver parsing and comparison for managed-dependency syncing.
+ *
+ * Version parsing and comparison are delegated to node-semver (the `semver`
+ * package), which implements full semver precedence including prerelease
+ * ordering (0.1.0-alpha.19 < 0.1.0-alpha.20 < 0.1.0) — the dependency-check
+ * parser in src/cli/external-requirements/versions.ts does not, as it drops
+ * prerelease tags, which here would make an alpha downgrade look like a no-op.
+ * The specifier classifier stays hand-rolled because the sync policy needs to
+ * know whether a declared range was written as tilde, caret, or an exact pin,
+ * and node-semver's Range API erases that distinction (it expands `~`/`^` into
+ * plain comparators).
+ */
+const semver_1 = require("semver");
+function parseVersion(version) {
+    // npm accepts a single leading 'v' or 'V' on version strings (v1.2.3, ~v1.2.3);
+    // node-semver only recognizes the lowercase form, so normalize before parsing.
+    const normalized = version.trim().replace(/^V/, 'v');
+    return (0, semver_1.parse)(normalized, { loose: false });
+}
+/**
+ * Parse an npm dependency specifier into exact / tilde / caret + base version.
+ * Anything else (file:, git:, workspace:, URLs, wildcards, compound ranges, tags)
+ * is 'unsupported' — the sync skips those rather than guessing. Strict parsing
+ * (no loose/coerce) keeps `1.x`, `*`, `latest`, and `>=1.2.3` unsupported.
+ */
+function parseSpecifier(raw) {
+    const trimmed = raw.trim();
+    let kind = 'exact';
+    let versionPart = trimmed;
+    if (trimmed.startsWith('~')) {
+        kind = 'tilde';
+        versionPart = trimmed.slice(1);
+    }
+    else if (trimmed.startsWith('^')) {
+        kind = 'caret';
+        versionPart = trimmed.slice(1);
+    }
+    else if (trimmed.startsWith('=')) {
+        versionPart = trimmed.slice(1);
+    }
+    const version = parseVersion(versionPart);
+    if (!version)
+        return { kind: 'unsupported', raw };
+    return { kind, version, raw };
+}
+//# sourceMappingURL=semver.js.map

package/dist/lib/dependency-management/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/semver.ts"],"names":[],"mappings":";;AAyBA,oCAKC;AAQD,wCAkBC;AAxDD;;;;;;;;;;;;GAYG;AACH,mCAA+B;AAY/B,SAAgB,YAAY,CAAC,OAAe;IAC1C,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,IAAA,cAAK,EAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAkB,OAAO,CAAC;IAClC,IAAI,WAAW,GAAG,OAAO,CAAC;IAE1B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,GAAG,OAAO,CAAC;QACf,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,OAAO,CAAC;QACf,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAChC,CAAC"}

package/dist/lib/dependency-management/sync.d.ts

@@ -0,0 +1,26 @@
+import type { DependencySyncResult, SyncManagedDependenciesOptions } from './types';
+/**
+ * Sync the managed dependencies of a vended CDK project to the versions this CLI
+ * release was tested with.
+ *
+ * The vended asset package.json is the source of truth: every dependency named in it
+ * is managed and rewritten to its vended specifier (tilde for stable deps so patches
+ * float, exact for the L3 constructs); everything else in the user's file is untouched.
+ * Projects that predate pinning (caret ranges) are migrated automatically. If the
+ * project declares a managed dependency newer than this CLI expects, the project was
+ * updated by a newer CLI (or the user bumped it manually) and this throws
+ * CliVersionTooOldError (downgraded to a warning when `disabled` or
+ * `treatSkewAsWarning`). When anything changed — or node_modules is missing —
+ * `npm install` reconciles the edited package.json against the existing lockfile
+ * incrementally; node_modules and the lockfile are never deleted, so user-added deps
+ * keep their resolved versions. If the install fails, the pre-rewrite package.json is
+ * restored so a retry recomputes the same plan and re-attempts the install.
+ *
+ * `mode: 'check'` computes the same plan/warnings/notice without writing or
+ * installing, for preview flows that must not mutate the working tree.
+ *
+ * All user-facing wording is returned on the result (`notice`, `warnings`) — callers
+ * only display it. Throws CliVersionTooOldError | DependencySyncError; never exits.
+ */
+export declare function syncManagedDependencies(options: SyncManagedDependenciesOptions): Promise<DependencySyncResult>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/lib/dependency-management/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/sync.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAAmB,8BAA8B,EAAE,MAAM,SAAS,CAAC;AAsBrG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkHpH"}

package/dist/lib/dependency-management/sync.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncManagedDependencies = syncManagedDependencies;
+const types_1 = require("../errors/types");
+const subprocess_1 = require("../utils/subprocess");
+const messages_1 = require("./messages");
+const plan_1 = require("./plan");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+async function readManifest(path, fileDescription) {
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(path, 'utf-8');
+    }
+    catch (err) {
+        throw new types_1.DependencySyncError(`Could not read ${fileDescription} at ${path}: ${String(err)}`, { cause: err });
+    }
+    try {
+        return { manifest: JSON.parse(raw), raw };
+    }
+    catch (err) {
+        throw new types_1.DependencySyncError(`Could not parse ${fileDescription} at ${path}: ${String(err)}`, { cause: err });
+    }
+}
+/**
+ * Sync the managed dependencies of a vended CDK project to the versions this CLI
+ * release was tested with.
+ *
+ * The vended asset package.json is the source of truth: every dependency named in it
+ * is managed and rewritten to its vended specifier (tilde for stable deps so patches
+ * float, exact for the L3 constructs); everything else in the user's file is untouched.
+ * Projects that predate pinning (caret ranges) are migrated automatically. If the
+ * project declares a managed dependency newer than this CLI expects, the project was
+ * updated by a newer CLI (or the user bumped it manually) and this throws
+ * CliVersionTooOldError (downgraded to a warning when `disabled` or
+ * `treatSkewAsWarning`). When anything changed — or node_modules is missing —
+ * `npm install` reconciles the edited package.json against the existing lockfile
+ * incrementally; node_modules and the lockfile are never deleted, so user-added deps
+ * keep their resolved versions. If the install fails, the pre-rewrite package.json is
+ * restored so a retry recomputes the same plan and re-attempts the install.
+ *
+ * `mode: 'check'` computes the same plan/warnings/notice without writing or
+ * installing, for preview flows that must not mutate the working tree.
+ *
+ * All user-facing wording is returned on the result (`notice`, `warnings`) — callers
+ * only display it. Throws CliVersionTooOldError | DependencySyncError; never exits.
+ */
+async function syncManagedDependencies(options) {
+    const { vendedPackageJsonPath, projectDir, disabled = false, mode = 'apply', treatSkewAsWarning = false, installCommand = messages_1.DEFAULT_CLI_INSTALL_COMMAND, } = options;
+    const checkOnly = mode === 'check';
+    const projectPackageJsonPath = (0, node_path_1.join)(projectDir, 'package.json');
+    const { manifest: vended } = await readManifest(vendedPackageJsonPath, 'the vended CDK package.json');
+    // Keep the raw pre-rewrite text: it's restored verbatim if npm install fails, so a
+    // retry recomputes the same plan instead of seeing an already-matching manifest.
+    const { manifest: project, raw: projectRaw } = await readManifest(projectPackageJsonPath, "the project's CDK package.json");
+    const plan = (0, plan_1.computeSyncPlan)(vended, project);
+    // `disabled` wins over check mode: an opted-out sync never writes regardless of mode.
+    const outcome = disabled ? 'opted-out' : checkOnly ? 'check-only' : 'synced';
+    const result = {
+        outcome,
+        optedOut: disabled,
+        checkOnly,
+        migratedFromCaret: plan.migratedFromCaret,
+        reinstalled: false,
+        skewWarning: false,
+        changes: plan.changes,
+        restored: plan.restored,
+        skipped: plan.skipped,
+        warnings: plan.skipped.map(messages_1.formatSkippedWarning),
+        notice: null,
+    };
+    if (plan.skew.length > 0) {
+        if (!disabled && !treatSkewAsWarning && !checkOnly) {
+            throw new types_1.CliVersionTooOldError((0, messages_1.formatCliUpgradeError)(plan.skew, installCommand));
+        }
+        result.skewWarning = true;
+        result.warnings.push((0, messages_1.formatSkewWarning)(plan.skew, installCommand));
+    }
+    if (disabled) {
+        return result;
+    }
+    const hasPlannedChanges = plan.changes.length > 0 || plan.restored.length > 0;
+    if (checkOnly) {
+        // Report what WOULD change without touching the working tree (future-tense wording).
+        result.notice = (0, messages_1.formatSyncNotice)({
+            migratedFromCaret: result.migratedFromCaret,
+            changes: result.changes,
+            restored: result.restored,
+            reinstalled: false,
+            applied: false,
+        });
+        return result;
+    }
+    if (hasPlannedChanges) {
+        // Mutate the parsed manifest in place so user key order and unknown fields survive.
+        for (const change of plan.changes) {
+            (project[change.section] ??= {})[change.name] = change.to;
+        }
+        for (const restoredDep of plan.restored) {
+            const section = (project[restoredDep.section] ??= {});
+            section[restoredDep.name] = restoredDep.to;
+        }
+        try {
+            await (0, promises_1.writeFile)(projectPackageJsonPath, JSON.stringify(project, null, 2) + '\n', 'utf-8');
+        }
+        catch (err) {
+            throw new types_1.DependencySyncError(`Failed to update the CDK project's dependencies: ${String(err)}`, { cause: err });
+        }
+    }
+    // Install when the manifest changed OR node_modules is missing (e.g. the user deleted it, or
+    // `create --no-install` never populated it). npm >=7 reconciles the edited package.json
+    // against the existing lockfile incrementally, so we never delete node_modules or the
+    // lockfile: user-added deps keep their resolved versions and installs stay warm.
+    const needsInstall = hasPlannedChanges || !(0, node_fs_1.existsSync)((0, node_path_1.join)(projectDir, 'node_modules'));
+    if (!needsInstall) {
+        return result;
+    }
+    const installResult = await (0, subprocess_1.runSubprocessCapture)('npm', ['install'], { cwd: projectDir });
+    if (installResult.code !== 0) {
+        // Restore the pre-rewrite package.json before failing. Without this, the retry would see a
+        // manifest that already matches the pins and an existing node_modules (a failed install
+        // doesn't remove it), skip the install, and deploy against the stale installed tree — the
+        // exact skew this sync exists to prevent. Restoring makes the retry recompute the same plan
+        // and re-attempt the install. Best-effort: a restore failure must not mask the install error.
+        if (hasPlannedChanges) {
+            await (0, promises_1.writeFile)(projectPackageJsonPath, projectRaw, 'utf-8').catch(() => undefined);
+        }
+        throw new types_1.DependencySyncError(`npm install failed after updating managed dependencies (exit ${String(installResult.code)}): ${installResult.stderr}`);
+    }
+    result.reinstalled = true;
+    result.notice = (0, messages_1.formatSyncNotice)({
+        migratedFromCaret: result.migratedFromCaret,
+        changes: result.changes,
+        restored: result.restored,
+        reinstalled: result.reinstalled,
+        applied: true,
+    });
+    return result;
+}
+//# sourceMappingURL=sync.js.map

package/dist/lib/dependency-management/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/sync.ts"],"names":[],"mappings":";;AAuDA,0DAkHC;AAzKD,2CAA6E;AAC7E,oDAA2D;AAC3D,yCAMoB;AACpB,iCAAyC;AAEzC,qCAAqC;AACrC,+CAAuD;AACvD,yCAAiC;AAEjC,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,eAAuB;IAEvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,2BAAmB,CAAC,kBAAkB,eAAe,OAAO,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,2BAAmB,CAAC,mBAAmB,eAAe,OAAO,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACI,KAAK,UAAU,uBAAuB,CAAC,OAAuC;IACnF,MAAM,EACJ,qBAAqB,EACrB,UAAU,EACV,QAAQ,GAAG,KAAK,EAChB,IAAI,GAAG,OAAO,EACd,kBAAkB,GAAG,KAAK,EAC1B,cAAc,GAAG,sCAA2B,GAC7C,GAAG,OAAO,CAAC;IACZ,MAAM,SAAS,GAAG,IAAI,KAAK,OAAO,CAAC;IACnC,MAAM,sBAAsB,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;IACtG,mFAAmF;IACnF,iFAAiF;IACjF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,CAC/D,sBAAsB,EACtB,gCAAgC,CACjC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,sBAAe,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,sFAAsF;IACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,MAAM,MAAM,GAAyB;QACnC,OAAO;QACP,QAAQ,EAAE,QAAQ;QAClB,SAAS;QACT,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,+BAAoB,CAAC;QAChD,MAAM,EAAE,IAAI;KACb,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,6BAAqB,CAAC,IAAA,gCAAqB,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,4BAAiB,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAE9E,IAAI,SAAS,EAAE,CAAC;QACd,qFAAqF;QACrF,MAAM,CAAC,MAAM,GAAG,IAAA,2BAAgB,EAAC;YAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,KAAK;YAClB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,oFAAoF;QACpF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,oBAAS,EAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAmB,CAAC,oDAAoD,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,wFAAwF;IACxF,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,YAAY,GAAG,iBAAiB,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,IAAA,iCAAoB,EAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,2FAA2F;QAC3F,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAA,oBAAS,EAAC,sBAAsB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,2BAAmB,CAC3B,gEAAgE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,CACvH,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAE1B,MAAM,CAAC,MAAM,GAAG,IAAA,2BAAgB,EAAC;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/dependency-management/types.d.ts

@@ -0,0 +1,85 @@
+export type DependencySection = 'dependencies' | 'devDependencies';
+/** A package.json shape that preserves unknown fields verbatim. */
+export interface PackageManifest {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    [key: string]: unknown;
+}
+export interface DependencyChange {
+    name: string;
+    section: DependencySection;
+    from: string;
+    to: string;
+}
+export interface RestoredDependency {
+    name: string;
+    section: DependencySection;
+    to: string;
+}
+export interface SkippedDependency {
+    name: string;
+    raw: string;
+    reason: string;
+}
+/**
+ * How the sync concluded:
+ * - 'synced': the sync ran in apply mode (rewrites/installs happened as needed).
+ * - 'check-only': `mode: 'check'` — plan computed, nothing written or installed.
+ * - 'opted-out': dependency management disabled via global config — nothing written.
+ * - 'skipped': the CLI layer skipped the sync entirely (AGENTCORE_SKIP_INSTALL).
+ * - 'failure-suppressed': the sync threw on a teardown deploy and the failure was
+ *   downgraded to a warning so the teardown could proceed.
+ * - 'failed': the sync threw and the deploy failed with it (CliVersionTooOldError, or
+ *   DependencySyncError on a non-teardown deploy). Attached by the CLI layer's failure
+ *   path purely so dep_sync_* telemetry records that the sync itself was the failure.
+ */
+export type DependencySyncOutcome = 'synced' | 'check-only' | 'opted-out' | 'skipped' | 'failure-suppressed' | 'failed';
+export interface DependencySyncResult {
+    /**
+     * Primary classification of the sync run. The booleans below preserve overlapping detail
+     * (e.g. an opted-out run in check mode also has `checkOnly: true`).
+     */
+    outcome: DependencySyncOutcome;
+    /** True when dependency management is disabled via global config — nothing was written. */
+    optedOut: boolean;
+    /** True when this was a check-only run (`mode: 'check'`) — plan computed, nothing written or installed. */
+    checkOnly: boolean;
+    /** True when the project predated pinning (caret ranges on managed deps were rewritten). */
+    migratedFromCaret: boolean;
+    /** True when `npm install` was run to reconcile the installed tree (manifest changed, or node_modules was missing). */
+    reinstalled: boolean;
+    /** True when a newer-than-CLI managed dep was found but downgraded to a warning (opted out or skew-as-warning). */
+    skewWarning: boolean;
+    changes: DependencyChange[];
+    restored: RestoredDependency[];
+    skipped: SkippedDependency[];
+    /** Ready-to-print warning lines (downgraded skew, skipped specifiers). */
+    warnings: string[];
+    /** Ready-to-print user notice (migration message and/or change summary), null if nothing to say. */
+    notice: string | null;
+}
+export interface SyncManagedDependenciesOptions {
+    /** Path to the CLI's vended CDK package.json — source of truth for managed names + versions. */
+    vendedPackageJsonPath: string;
+    /** The user project's CDK directory (contains package.json, node_modules, lockfile). */
+    projectDir: string;
+    /** From global config `disableDependencyManagement`. When true: no writes, skew becomes a warning. */
+    disabled?: boolean;
+    /**
+     * 'apply' (default) rewrites package.json and installs; 'check' only computes the plan and
+     * user-facing wording — no writes, no install. Used by preview modes (--dry-run / --diff),
+     * which must never mutate the working tree.
+     */
+    mode?: 'apply' | 'check';
+    /**
+     * Downgrade newer-than-CLI skew from CliVersionTooOldError to a warning even when managed.
+     * Used by teardown deploys, where skew must not block destroying a cost-incurring stack.
+     */
+    treatSkewAsWarning?: boolean;
+    /**
+     * CLI upgrade command used in skew errors/warnings. The CLI layer passes the distro-aware
+     * `getDistroConfig().installCommand`; defaults keep the lib module usable standalone.
+     */
+    installCommand?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/dependency-management/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,iBAAiB,CAAC;AAEnE,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,GAAG,oBAAoB,GAAG,QAAQ,CAAC;AAExH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,OAAO,EAAE,qBAAqB,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,2GAA2G;IAC3G,SAAS,EAAE,OAAO,CAAC;IACnB,4FAA4F;IAC5F,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uHAAuH;IACvH,WAAW,EAAE,OAAO,CAAC;IACrB,mHAAmH;IACnH,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oGAAoG;IACpG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,8BAA8B;IAC7C,gGAAgG;IAChG,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACzB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/lib/dependency-management/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/lib/dependency-management/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/types.ts"],"names":[],"mappings":""}