@aws/agentcore 1.0.0-preview.3 → 1.0.0-preview.30

package/dist/lib/constants.d.ts

@@ -29,9 +29,13 @@ export declare const CONTAINER_INTERNAL_PORT = 8080;
 export type ContainerRuntime = 'docker' | 'podman' | 'finch';
 export declare const CONTAINER_RUNTIMES: ContainerRuntime[];
 /**
- * Get the Dockerfile path for a given code location.
- * @param codeLocation - Directory containing the Dockerfile
- * @param dockerfile - Custom Dockerfile name (default: 'Dockerfile')
+ * Resolve the Dockerfile path against the Docker build context.
+ * @param buildContext - The build context directory (`buildContextPath` when set, else `codeLocation`)
+ * @param dockerfile - Dockerfile name or relative subpath within the context (default: 'Dockerfile')
+ *
+ * `dockerfile` may be a filename ('Dockerfile') or a forward-slash relative subpath
+ * ('docker/Dockerfile'); absolute paths, backslashes, and `..` traversal are rejected so it can
+ * never escape the build context.
  */
-export declare function getDockerfilePath(codeLocation: string, dockerfile?: string): string;
+export declare function getDockerfilePath(buildContext: string, dockerfile?: string): string;
 //# sourceMappingURL=constants.d.ts.map

package/dist/lib/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAGA,cAAc,WAAW,CAAC;AAG1B,eAAO,MAAM,UAAU,cAAc,CAAC;AAGtC,eAAO,MAAM,OAAO,QAAQ,CAAC;AAC7B,eAAO,MAAM,cAAc,QAAQ,CAAC;AAGpC,eAAO,MAAM,WAAW,cAAc,CAAC;AAGvC,eAAO,MAAM,cAAc,SAAS,CAAC;AACrC,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AAEX,gFAAgF;AAChF,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,eAAO,MAAM,eAAe,gGACmE,CAAC;AAChG,eAAO,MAAM,gBAAgB,wEAAwE,CAAC;AACtG,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAG/D,eAAO,MAAM,MAAM,QAAqB,CAAC;AACzC,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC7D,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAAkC,CAAC;AAEpF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAMnF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAIA,cAAc,WAAW,CAAC;AAG1B,eAAO,MAAM,UAAU,cAAc,CAAC;AAGtC,eAAO,MAAM,OAAO,QAAQ,CAAC;AAC7B,eAAO,MAAM,cAAc,QAAQ,CAAC;AAGpC,eAAO,MAAM,WAAW,cAAc,CAAC;AAGvC,eAAO,MAAM,cAAc,SAAS,CAAC;AACrC,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AAEX,gFAAgF;AAChF,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,eAAO,MAAM,eAAe,gGACmE,CAAC;AAChG,eAAO,MAAM,gBAAgB,wEAAwE,CAAC;AACtG,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAG/D,eAAO,MAAM,MAAM,QAAqB,CAAC;AACzC,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC7D,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAAkC,CAAC;AAEpF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CASnF"}

package/dist/lib/constants.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONTAINER_RUNTIMES = exports.CONTAINER_INTERNAL_PORT = exports.DOCKERFILE_NAME = exports.ONE_GB = exports.DEFAULT_PYTHON_PLATFORM = exports.NPM_INSTALL_HINT = exports.UV_INSTALL_HINT = exports.ENV_FILE = exports.CONFIG_FILES = exports.CLI_LOGS_DIR = exports.CLI_SYSTEM_DIR = exports.HARNESS_DIR = exports.MCP_APP_SUBDIR = exports.APP_DIR = exports.CONFIG_DIR = void 0;
 exports.getArtifactZipName = getArtifactZipName;
 exports.getDockerfilePath = getDockerfilePath;
+const schema_1 = require("../schema");
 const path_1 = require("path");
 // Re-export all schema constants from schema
 __exportStar(require("../schema"), exports);
@@ -55,15 +56,20 @@ exports.DOCKERFILE_NAME = 'Dockerfile';
 exports.CONTAINER_INTERNAL_PORT = 8080;
 exports.CONTAINER_RUNTIMES = ['docker', 'podman', 'finch'];
 /**
- * Get the Dockerfile path for a given code location.
- * @param codeLocation - Directory containing the Dockerfile
- * @param dockerfile - Custom Dockerfile name (default: 'Dockerfile')
+ * Resolve the Dockerfile path against the Docker build context.
+ * @param buildContext - The build context directory (`buildContextPath` when set, else `codeLocation`)
+ * @param dockerfile - Dockerfile name or relative subpath within the context (default: 'Dockerfile')
+ *
+ * `dockerfile` may be a filename ('Dockerfile') or a forward-slash relative subpath
+ * ('docker/Dockerfile'); absolute paths, backslashes, and `..` traversal are rejected so it can
+ * never escape the build context.
  */
-function getDockerfilePath(codeLocation, dockerfile) {
+function getDockerfilePath(buildContext, dockerfile) {
     const name = dockerfile ?? exports.DOCKERFILE_NAME;
-    if (name.includes('/') || name.includes('\\') || name.includes('..')) {
-        throw new Error(`Invalid dockerfile name: must be a filename without path separators or traversal`);
+    if (!(0, schema_1.isValidDockerfilePath)(name)) {
+        throw new Error(`Invalid dockerfile path "${name}": must be a relative path within the build context (a filename or ` +
+            `forward-slash subpath; no leading slash, backslash, empty segments, or ".." traversal)`);
     }
-    return (0, path_1.join)(codeLocation, name);
+    return (0, path_1.join)(buildContext, name);
 }
 //# sourceMappingURL=constants.js.map

package/dist/lib/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkCA,gDAEC;AAqBD,8CAMC;AA/DD,+BAA4B;AAE5B,6CAA6C;AAC7C,4CAA0B;AAE1B,yCAAyC;AAC5B,QAAA,UAAU,GAAG,WAAW,CAAC;AAEtC,kEAAkE;AACrD,QAAA,OAAO,GAAG,KAAK,CAAC;AAChB,QAAA,cAAc,GAAG,KAAK,CAAC;AAEpC,sBAAsB;AACT,QAAA,WAAW,GAAG,WAAW,CAAC;AAEvC,8CAA8C;AACjC,QAAA,cAAc,GAAG,MAAM,CAAC;AACxB,QAAA,YAAY,GAAG,MAAM,CAAC;AAEtB,QAAA,YAAY,GAAG;IAC1B,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,kBAAkB;IAC/B,cAAc,EAAE,qBAAqB;IACrC,QAAQ,EAAE,eAAe;CACjB,CAAC;AAEX,gFAAgF;AACnE,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAEY,QAAA,eAAe,GAC1B,6FAA6F,CAAC;AACnF,QAAA,gBAAgB,GAAG,qEAAqE,CAAC;AACzF,QAAA,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D,sBAAsB;AACT,QAAA,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5B,QAAA,eAAe,GAAG,YAAY,CAAC;AAC/B,QAAA,uBAAuB,GAAG,IAAI,CAAC;AAI/B,QAAA,kBAAkB,GAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEpF;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,YAAoB,EAAE,UAAmB;IACzE,MAAM,IAAI,GAAG,UAAU,IAAI,uBAAe,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAA,WAAI,EAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAmCA,gDAEC;AAyBD,8CASC;AAvED,sCAAkD;AAClD,+BAA4B;AAE5B,6CAA6C;AAC7C,4CAA0B;AAE1B,yCAAyC;AAC5B,QAAA,UAAU,GAAG,WAAW,CAAC;AAEtC,kEAAkE;AACrD,QAAA,OAAO,GAAG,KAAK,CAAC;AAChB,QAAA,cAAc,GAAG,KAAK,CAAC;AAEpC,sBAAsB;AACT,QAAA,WAAW,GAAG,WAAW,CAAC;AAEvC,8CAA8C;AACjC,QAAA,cAAc,GAAG,MAAM,CAAC;AACxB,QAAA,YAAY,GAAG,MAAM,CAAC;AAEtB,QAAA,YAAY,GAAG;IAC1B,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,kBAAkB;IAC/B,cAAc,EAAE,qBAAqB;IACrC,QAAQ,EAAE,eAAe;CACjB,CAAC;AAEX,gFAAgF;AACnE,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAEY,QAAA,eAAe,GAC1B,6FAA6F,CAAC;AACnF,QAAA,gBAAgB,GAAG,qEAAqE,CAAC;AACzF,QAAA,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D,sBAAsB;AACT,QAAA,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5B,QAAA,eAAe,GAAG,YAAY,CAAC;AAC/B,QAAA,uBAAuB,GAAG,IAAI,CAAC;AAI/B,QAAA,kBAAkB,GAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEpF;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,YAAoB,EAAE,UAAmB;IACzE,MAAM,IAAI,GAAG,UAAU,IAAI,uBAAe,CAAC;IAC3C,IAAI,CAAC,IAAA,8BAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,qEAAqE;YACnG,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,WAAI,EAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/lib/dependency-management/index.d.ts

@@ -0,0 +1,5 @@
+export { syncManagedDependencies } from './sync';
+export { computeSyncPlan } from './plan';
+export type { SkewFinding, SyncPlan } from './plan';
+export type { DependencyChange, DependencySyncOutcome, DependencySyncResult, PackageManifest, RestoredDependency, SkippedDependency, SyncManagedDependenciesOptions, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/dependency-management/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACpD,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,SAAS,CAAC"}

package/dist/lib/dependency-management/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSyncPlan = exports.syncManagedDependencies = void 0;
+var sync_1 = require("./sync");
+Object.defineProperty(exports, "syncManagedDependencies", { enumerable: true, get: function () { return sync_1.syncManagedDependencies; } });
+var plan_1 = require("./plan");
+Object.defineProperty(exports, "computeSyncPlan", { enumerable: true, get: function () { return plan_1.computeSyncPlan; } });
+//# sourceMappingURL=index.js.map

package/dist/lib/dependency-management/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/index.ts"],"names":[],"mappings":";;;AAAA,+BAAiD;AAAxC,+GAAA,uBAAuB,OAAA;AAChC,+BAAyC;AAAhC,uGAAA,eAAe,OAAA"}

package/dist/lib/dependency-management/messages.d.ts

@@ -0,0 +1,30 @@
+import type { SkewFinding } from './plan';
+import type { DependencyChange, RestoredDependency, SkippedDependency } from './types';
+/**
+ * Single source of user-facing wording for dependency management, so the
+ * headless and TUI deploy paths (and any future CLI) can't drift apart.
+ */
+/**
+ * Fallback CLI install command when the caller doesn't thread one in. The CLI layer
+ * passes `getDistroConfig().installCommand` (dist-tag/registry aware); this default
+ * keeps the lib module usable standalone.
+ */
+export declare const DEFAULT_CLI_INSTALL_COMMAND = "npm install -g @aws/agentcore@latest";
+export declare const OPT_OUT_HINT = "To manage these versions yourself: agentcore config disableDependencyManagement true";
+/**
+ * Error text for newer-than-CLI skew. Names the skewed dependencies, gives the
+ * distro-correct upgrade command, and — because the skew may be a deliberate manual
+ * bump rather than a newer CLI — points at the opt-out as the alternative.
+ */
+export declare function formatCliUpgradeError(skew: SkewFinding[], installCommand: string): string;
+export declare function formatSyncNotice(options: {
+    migratedFromCaret: boolean;
+    changes: DependencyChange[];
+    restored: RestoredDependency[];
+    reinstalled: boolean;
+    /** False in check mode — nothing was written, so speak in the future tense. */
+    applied: boolean;
+}): string | null;
+export declare function formatSkewWarning(skew: SkewFinding[], installCommand: string): string;
+export declare function formatSkippedWarning(skipped: SkippedDependency): string;
+//# sourceMappingURL=messages.d.ts.map

package/dist/lib/dependency-management/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/messages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEvF;;;GAGG;AAEH;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,yCAAyC,CAAC;AAElF,eAAO,MAAM,YAAY,yFAAyF,CAAC;AAiBnH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAUzF;AAYD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,WAAW,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG,MAAM,GAAG,IAAI,CA6BhB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAKrF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEvE"}

package/dist/lib/dependency-management/messages.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPT_OUT_HINT = exports.DEFAULT_CLI_INSTALL_COMMAND = void 0;
+exports.formatCliUpgradeError = formatCliUpgradeError;
+exports.formatSyncNotice = formatSyncNotice;
+exports.formatSkewWarning = formatSkewWarning;
+exports.formatSkippedWarning = formatSkippedWarning;
+/**
+ * Single source of user-facing wording for dependency management, so the
+ * headless and TUI deploy paths (and any future CLI) can't drift apart.
+ */
+/**
+ * Fallback CLI install command when the caller doesn't thread one in. The CLI layer
+ * passes `getDistroConfig().installCommand` (dist-tag/registry aware); this default
+ * keeps the lib module usable standalone.
+ */
+exports.DEFAULT_CLI_INSTALL_COMMAND = 'npm install -g @aws/agentcore@latest';
+exports.OPT_OUT_HINT = 'To manage these versions yourself: agentcore config disableDependencyManagement true';
+const MIGRATION_PREAMBLE = 'Your project was created before the AgentCore CLI managed dependency versions.\n' +
+    "We've updated agentcore/cdk/package.json so the CLI keeps these dependencies\n" +
+    'on versions it has been tested with (patch updates still apply automatically):';
+// Check-mode variant: nothing was written, so the wording must promise rather than claim.
+const MIGRATION_PREAMBLE_PENDING = 'Your project was created before the AgentCore CLI managed dependency versions.\n' +
+    'agentcore/cdk/package.json will be updated on the next deploy so the CLI keeps these\n' +
+    'dependencies on versions it has been tested with (patch updates still apply automatically):';
+function formatSkewList(skew) {
+    return skew.map(s => `${s.name} (${s.declared}, CLI expects ${s.expected})`).join(', ');
+}
+/**
+ * Error text for newer-than-CLI skew. Names the skewed dependencies, gives the
+ * distro-correct upgrade command, and — because the skew may be a deliberate manual
+ * bump rather than a newer CLI — points at the opt-out as the alternative.
+ */
+function formatCliUpgradeError(skew, installCommand) {
+    const plural = skew.length > 1;
+    return (`This project requires a newer version of the AgentCore CLI: ${formatSkewList(skew)} ` +
+        `${plural ? 'are' : 'is'} newer than this CLI was tested with. ` +
+        `Run \`${installCommand}\` and retry.\n` +
+        `If you intentionally updated ${plural ? 'these dependencies' : 'this dependency'} yourself, ` +
+        'you can disable managed dependency versions instead:\n' +
+        exports.OPT_OUT_HINT);
+}
+function formatChangeTable(changes, restored) {
+    const rows = [
+        ...changes.map(c => ({ name: c.name, from: c.from, to: c.to })),
+        ...restored.map(r => ({ name: r.name, from: '(removed)', to: r.to })),
+    ];
+    const nameWidth = Math.max(...rows.map(r => r.name.length));
+    const fromWidth = Math.max(...rows.map(r => r.from.length));
+    return rows.map(r => `  ${r.name.padEnd(nameWidth)}  ${r.from.padEnd(fromWidth)} → ${r.to}`).join('\n');
+}
+function formatSyncNotice(options) {
+    const { migratedFromCaret, changes, restored, reinstalled, applied } = options;
+    if (changes.length === 0 && restored.length === 0)
+        return null;
+    const lines = [];
+    if (migratedFromCaret) {
+        lines.push(applied ? MIGRATION_PREAMBLE : MIGRATION_PREAMBLE_PENDING);
+    }
+    else {
+        lines.push(applied
+            ? 'Updated managed dependencies in agentcore/cdk/package.json:'
+            : 'Managed dependencies in agentcore/cdk/package.json will be updated on the next deploy:');
+    }
+    lines.push('');
+    lines.push(formatChangeTable(changes, restored));
+    lines.push('');
+    if (reinstalled) {
+        lines.push('Ran npm install in agentcore/cdk to apply the updates.');
+    }
+    lines.push(applied
+        ? 'Dependencies you added yourself were not changed.'
+        : 'Dependencies you added yourself will not be changed.');
+    if (migratedFromCaret) {
+        lines.push(exports.OPT_OUT_HINT);
+    }
+    return lines.join('\n');
+}
+function formatSkewWarning(skew, installCommand) {
+    return (`${formatSkewList(skew)} ${skew.length === 1 ? 'is' : 'are'} newer than this CLI was tested with; ` +
+        `deploy may fail — upgrade the CLI with \`${installCommand}\`. ${exports.OPT_OUT_HINT}`);
+}
+function formatSkippedWarning(skipped) {
+    return `${skipped.name} (${skipped.raw}) ${skipped.reason}.`;
+}
+//# sourceMappingURL=messages.js.map

package/dist/lib/dependency-management/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/messages.ts"],"names":[],"mappings":";;;AAqCA,sDAUC;AAYD,4CAoCC;AAED,8CAKC;AAED,oDAEC;AAvGD;;;GAGG;AAEH;;;;GAIG;AACU,QAAA,2BAA2B,GAAG,sCAAsC,CAAC;AAErE,QAAA,YAAY,GAAG,sFAAsF,CAAC;AAEnH,MAAM,kBAAkB,GACtB,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF,CAAC;AAEnF,0FAA0F;AAC1F,MAAM,0BAA0B,GAC9B,kFAAkF;IAClF,wFAAwF;IACxF,6FAA6F,CAAC;AAEhG,SAAS,cAAc,CAAC,IAAmB;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,iBAAiB,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAAmB,EAAE,cAAsB;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,+DAA+D,cAAc,CAAC,IAAI,CAAC,GAAG;QACtF,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,wCAAwC;QAChE,SAAS,cAAc,iBAAiB;QACxC,gCAAgC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,aAAa;QAC9F,wDAAwD;QACxD,oBAAY,CACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA2B,EAAE,QAA8B;IACpF,MAAM,IAAI,GAAiD;QACzD,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACtE,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAOhC;IACC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,OAAO;YACL,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,wFAAwF,CAC7F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,OAAO;QACL,CAAC,CAAC,mDAAmD;QACrD,CAAC,CAAC,sDAAsD,CAC3D,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,oBAAY,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAmB,EAAE,cAAsB;IAC3E,OAAO,CACL,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,wCAAwC;QACnG,4CAA4C,cAAc,OAAO,oBAAY,EAAE,CAChF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAA0B;IAC7D,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;AAC/D,CAAC"}

package/dist/lib/dependency-management/plan.d.ts

@@ -0,0 +1,25 @@
+import type { DependencyChange, PackageManifest, RestoredDependency, SkippedDependency } from './types';
+/**
+ * Pure policy computation for managed-dependency syncing. No I/O.
+ *
+ * A dependency is "managed" iff its name appears in the vended manifest
+ * (dependencies or devDependencies). The vended specifier is authoritative:
+ * the sync copies it verbatim, so the pinning policy (tilde for stable deps,
+ * exact for L3 constructs) lives entirely in the vended asset.
+ */
+export interface SkewFinding {
+    name: string;
+    declared: string;
+    expected: string;
+}
+export interface SyncPlan {
+    /** Managed deps where the project declares a newer minor/major than the CLI expects. */
+    skew: SkewFinding[];
+    changes: DependencyChange[];
+    restored: RestoredDependency[];
+    skipped: SkippedDependency[];
+    /** True when any managed dep had a caret range — the project predates pinning. */
+    migratedFromCaret: boolean;
+}
+export declare function computeSyncPlan(vended: PackageManifest, project: PackageManifest): SyncPlan;
+//# sourceMappingURL=plan.d.ts.map

package/dist/lib/dependency-management/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/plan.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAEhB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAGjB;;;;;;;GAOG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,wFAAwF;IACxF,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kFAAkF;IAClF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AA2BD,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,GAAG,QAAQ,CAuC3F"}

package/dist/lib/dependency-management/plan.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeSyncPlan = computeSyncPlan;
+const semver_1 = require("./semver");
+const semver_2 = require("semver");
+const SECTIONS = ['dependencies', 'devDependencies'];
+function findDeclared(manifest, name) {
+    for (const section of SECTIONS) {
+        const raw = manifest[section]?.[name];
+        if (raw !== undefined)
+            return { section, raw };
+    }
+    return null;
+}
+/**
+ * Skew exists when the project's declared base version is ahead of the CLI's
+ * expectation in a way patch-floating can't explain: a higher major.minor for
+ * ranged deps, or any prerelease-aware greater-than for exact pins (so an
+ * alpha.20 project is never silently downgraded to an alpha.19 CLI's pin).
+ */
+function isSkewed(declared, expected) {
+    if (declared.kind === 'unsupported' || expected.kind === 'unsupported')
+        return false;
+    const d = declared.version;
+    const e = expected.version;
+    if (expected.kind === 'exact')
+        return (0, semver_2.compare)(d, e) > 0;
+    if (d.major !== e.major)
+        return d.major > e.major;
+    return d.minor > e.minor;
+}
+function computeSyncPlan(vended, project) {
+    const plan = { skew: [], changes: [], restored: [], skipped: [], migratedFromCaret: false };
+    for (const section of SECTIONS) {
+        for (const [name, expectedRaw] of Object.entries(vended[section] ?? {})) {
+            const expected = (0, semver_1.parseSpecifier)(expectedRaw);
+            const declared = findDeclared(project, name);
+            if (!declared) {
+                // Managed dep deleted by the user — the vended CDK app can't build without it.
+                plan.restored.push({ name, section, to: expectedRaw });
+                continue;
+            }
+            if (declared.raw === expectedRaw)
+                continue;
+            const declaredSpec = (0, semver_1.parseSpecifier)(declared.raw);
+            if (declaredSpec.kind === 'unsupported') {
+                // file:/git:/tag/range specifiers (incl. the bundled-tarball override) are
+                // deliberate local overrides — never rewrite, never skew-check.
+                plan.skipped.push({
+                    name,
+                    raw: declared.raw,
+                    reason: 'uses a non-semver specifier and was left unmanaged',
+                });
+                continue;
+            }
+            if (isSkewed(declaredSpec, expected)) {
+                plan.skew.push({ name, declared: declared.raw, expected: expectedRaw });
+                continue;
+            }
+            if (declaredSpec.kind === 'caret')
+                plan.migratedFromCaret = true;
+            plan.changes.push({ name, section: declared.section, from: declared.raw, to: expectedRaw });
+        }
+    }
+    return plan;
+}
+//# sourceMappingURL=plan.js.map

package/dist/lib/dependency-management/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/plan.ts"],"names":[],"mappings":";;AA6DA,0CAuCC;AApGD,qCAA0C;AAS1C,mCAAiC;AA2BjC,MAAM,QAAQ,GAAwB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,QAAyB,EAAE,IAAY;IAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,QAAyB;IACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAA,gBAAO,EAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED,SAAgB,eAAe,CAAC,MAAuB,EAAE,OAAwB;IAC/E,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAEtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,IAAA,uBAAc,EAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,+EAA+E;gBAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW;gBAAE,SAAS;YAE3C,MAAM,YAAY,GAAG,IAAA,uBAAc,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,YAAY,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACxC,2EAA2E;gBAC3E,gEAAgE;gBAChE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAChB,IAAI;oBACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;oBACjB,MAAM,EAAE,oDAAoD;iBAC7D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/dependency-management/semver.d.ts

@@ -0,0 +1,21 @@
+import type { SemVer } from 'semver';
+/** A parsed version: node-semver's SemVer (major / minor / patch / prerelease). */
+export type ParsedVersion = SemVer;
+export type SpecifierKind = 'exact' | 'tilde' | 'caret';
+export type ParsedSpecifier = {
+    kind: SpecifierKind;
+    version: ParsedVersion;
+    raw: string;
+} | {
+    kind: 'unsupported';
+    raw: string;
+};
+export declare function parseVersion(version: string): ParsedVersion | null;
+/**
+ * Parse an npm dependency specifier into exact / tilde / caret + base version.
+ * Anything else (file:, git:, workspace:, URLs, wildcards, compound ranges, tags)
+ * is 'unsupported' — the sync skips those rather than guessing. Strict parsing
+ * (no loose/coerce) keeps `1.x`, `*`, `latest`, and `>=1.2.3` unsupported.
+ */
+export declare function parseSpecifier(raw: string): ParsedSpecifier;
+//# sourceMappingURL=semver.d.ts.map

package/dist/lib/dependency-management/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/semver.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAKlE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAkB3D"}

package/dist/lib/dependency-management/semver.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseVersion = parseVersion;
+exports.parseSpecifier = parseSpecifier;
+/**
+ * Semver parsing and comparison for managed-dependency syncing.
+ *
+ * Version parsing and comparison are delegated to node-semver (the `semver`
+ * package), which implements full semver precedence including prerelease
+ * ordering (0.1.0-alpha.19 < 0.1.0-alpha.20 < 0.1.0) — the dependency-check
+ * parser in src/cli/external-requirements/versions.ts does not, as it drops
+ * prerelease tags, which here would make an alpha downgrade look like a no-op.
+ * The specifier classifier stays hand-rolled because the sync policy needs to
+ * know whether a declared range was written as tilde, caret, or an exact pin,
+ * and node-semver's Range API erases that distinction (it expands `~`/`^` into
+ * plain comparators).
+ */
+const semver_1 = require("semver");
+function parseVersion(version) {
+    // npm accepts a single leading 'v' or 'V' on version strings (v1.2.3, ~v1.2.3);
+    // node-semver only recognizes the lowercase form, so normalize before parsing.
+    const normalized = version.trim().replace(/^V/, 'v');
+    return (0, semver_1.parse)(normalized, { loose: false });
+}
+/**
+ * Parse an npm dependency specifier into exact / tilde / caret + base version.
+ * Anything else (file:, git:, workspace:, URLs, wildcards, compound ranges, tags)
+ * is 'unsupported' — the sync skips those rather than guessing. Strict parsing
+ * (no loose/coerce) keeps `1.x`, `*`, `latest`, and `>=1.2.3` unsupported.
+ */
+function parseSpecifier(raw) {
+    const trimmed = raw.trim();
+    let kind = 'exact';
+    let versionPart = trimmed;
+    if (trimmed.startsWith('~')) {
+        kind = 'tilde';
+        versionPart = trimmed.slice(1);
+    }
+    else if (trimmed.startsWith('^')) {
+        kind = 'caret';
+        versionPart = trimmed.slice(1);
+    }
+    else if (trimmed.startsWith('=')) {
+        versionPart = trimmed.slice(1);
+    }
+    const version = parseVersion(versionPart);
+    if (!version)
+        return { kind: 'unsupported', raw };
+    return { kind, version, raw };
+}
+//# sourceMappingURL=semver.js.map

package/dist/lib/dependency-management/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/semver.ts"],"names":[],"mappings":";;AAyBA,oCAKC;AAQD,wCAkBC;AAxDD;;;;;;;;;;;;GAYG;AACH,mCAA+B;AAY/B,SAAgB,YAAY,CAAC,OAAe;IAC1C,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,IAAA,cAAK,EAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAkB,OAAO,CAAC;IAClC,IAAI,WAAW,GAAG,OAAO,CAAC;IAE1B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,GAAG,OAAO,CAAC;QACf,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,OAAO,CAAC;QACf,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAChC,CAAC"}

package/dist/lib/dependency-management/sync.d.ts

@@ -0,0 +1,26 @@
+import type { DependencySyncResult, SyncManagedDependenciesOptions } from './types';
+/**
+ * Sync the managed dependencies of a vended CDK project to the versions this CLI
+ * release was tested with.
+ *
+ * The vended asset package.json is the source of truth: every dependency named in it
+ * is managed and rewritten to its vended specifier (tilde for stable deps so patches
+ * float, exact for the L3 constructs); everything else in the user's file is untouched.
+ * Projects that predate pinning (caret ranges) are migrated automatically. If the
+ * project declares a managed dependency newer than this CLI expects, the project was
+ * updated by a newer CLI (or the user bumped it manually) and this throws
+ * CliVersionTooOldError (downgraded to a warning when `disabled` or
+ * `treatSkewAsWarning`). When anything changed — or node_modules is missing —
+ * `npm install` reconciles the edited package.json against the existing lockfile
+ * incrementally; node_modules and the lockfile are never deleted, so user-added deps
+ * keep their resolved versions. If the install fails, the pre-rewrite package.json is
+ * restored so a retry recomputes the same plan and re-attempts the install.
+ *
+ * `mode: 'check'` computes the same plan/warnings/notice without writing or
+ * installing, for preview flows that must not mutate the working tree.
+ *
+ * All user-facing wording is returned on the result (`notice`, `warnings`) — callers
+ * only display it. Throws CliVersionTooOldError | DependencySyncError; never exits.
+ */
+export declare function syncManagedDependencies(options: SyncManagedDependenciesOptions): Promise<DependencySyncResult>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/lib/dependency-management/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/lib/dependency-management/sync.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAAmB,8BAA8B,EAAE,MAAM,SAAS,CAAC;AAsBrG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkHpH"}

package/dist/lib/dependency-management/sync.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncManagedDependencies = syncManagedDependencies;
+const types_1 = require("../errors/types");
+const subprocess_1 = require("../utils/subprocess");
+const messages_1 = require("./messages");
+const plan_1 = require("./plan");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+async function readManifest(path, fileDescription) {
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(path, 'utf-8');
+    }
+    catch (err) {
+        throw new types_1.DependencySyncError(`Could not read ${fileDescription} at ${path}: ${String(err)}`, { cause: err });
+    }
+    try {
+        return { manifest: JSON.parse(raw), raw };
+    }
+    catch (err) {
+        throw new types_1.DependencySyncError(`Could not parse ${fileDescription} at ${path}: ${String(err)}`, { cause: err });
+    }
+}
+/**
+ * Sync the managed dependencies of a vended CDK project to the versions this CLI
+ * release was tested with.
+ *
+ * The vended asset package.json is the source of truth: every dependency named in it
+ * is managed and rewritten to its vended specifier (tilde for stable deps so patches
+ * float, exact for the L3 constructs); everything else in the user's file is untouched.
+ * Projects that predate pinning (caret ranges) are migrated automatically. If the
+ * project declares a managed dependency newer than this CLI expects, the project was
+ * updated by a newer CLI (or the user bumped it manually) and this throws
+ * CliVersionTooOldError (downgraded to a warning when `disabled` or
+ * `treatSkewAsWarning`). When anything changed — or node_modules is missing —
+ * `npm install` reconciles the edited package.json against the existing lockfile
+ * incrementally; node_modules and the lockfile are never deleted, so user-added deps
+ * keep their resolved versions. If the install fails, the pre-rewrite package.json is
+ * restored so a retry recomputes the same plan and re-attempts the install.
+ *
+ * `mode: 'check'` computes the same plan/warnings/notice without writing or
+ * installing, for preview flows that must not mutate the working tree.
+ *
+ * All user-facing wording is returned on the result (`notice`, `warnings`) — callers
+ * only display it. Throws CliVersionTooOldError | DependencySyncError; never exits.
+ */
+async function syncManagedDependencies(options) {
+    const { vendedPackageJsonPath, projectDir, disabled = false, mode = 'apply', treatSkewAsWarning = false, installCommand = messages_1.DEFAULT_CLI_INSTALL_COMMAND, } = options;
+    const checkOnly = mode === 'check';
+    const projectPackageJsonPath = (0, node_path_1.join)(projectDir, 'package.json');
+    const { manifest: vended } = await readManifest(vendedPackageJsonPath, 'the vended CDK package.json');
+    // Keep the raw pre-rewrite text: it's restored verbatim if npm install fails, so a
+    // retry recomputes the same plan instead of seeing an already-matching manifest.
+    const { manifest: project, raw: projectRaw } = await readManifest(projectPackageJsonPath, "the project's CDK package.json");
+    const plan = (0, plan_1.computeSyncPlan)(vended, project);
+    // `disabled` wins over check mode: an opted-out sync never writes regardless of mode.
+    const outcome = disabled ? 'opted-out' : checkOnly ? 'check-only' : 'synced';
+    const result = {
+        outcome,
+        optedOut: disabled,
+        checkOnly,
+        migratedFromCaret: plan.migratedFromCaret,
+        reinstalled: false,
+        skewWarning: false,
+        changes: plan.changes,
+        restored: plan.restored,
+        skipped: plan.skipped,
+        warnings: plan.skipped.map(messages_1.formatSkippedWarning),
+        notice: null,
+    };
+    if (plan.skew.length > 0) {
+        if (!disabled && !treatSkewAsWarning && !checkOnly) {
+            throw new types_1.CliVersionTooOldError((0, messages_1.formatCliUpgradeError)(plan.skew, installCommand));
+        }
+        result.skewWarning = true;
+        result.warnings.push((0, messages_1.formatSkewWarning)(plan.skew, installCommand));
+    }
+    if (disabled) {
+        return result;
+    }
+    const hasPlannedChanges = plan.changes.length > 0 || plan.restored.length > 0;
+    if (checkOnly) {
+        // Report what WOULD change without touching the working tree (future-tense wording).
+        result.notice = (0, messages_1.formatSyncNotice)({
+            migratedFromCaret: result.migratedFromCaret,
+            changes: result.changes,
+            restored: result.restored,
+            reinstalled: false,
+            applied: false,
+        });
+        return result;
+    }
+    if (hasPlannedChanges) {
+        // Mutate the parsed manifest in place so user key order and unknown fields survive.
+        for (const change of plan.changes) {
+            (project[change.section] ??= {})[change.name] = change.to;
+        }
+        for (const restoredDep of plan.restored) {
+            const section = (project[restoredDep.section] ??= {});
+            section[restoredDep.name] = restoredDep.to;
+        }
+        try {
+            await (0, promises_1.writeFile)(projectPackageJsonPath, JSON.stringify(project, null, 2) + '\n', 'utf-8');
+        }
+        catch (err) {
+            throw new types_1.DependencySyncError(`Failed to update the CDK project's dependencies: ${String(err)}`, { cause: err });
+        }
+    }
+    // Install when the manifest changed OR node_modules is missing (e.g. the user deleted it, or
+    // `create --no-install` never populated it). npm >=7 reconciles the edited package.json
+    // against the existing lockfile incrementally, so we never delete node_modules or the
+    // lockfile: user-added deps keep their resolved versions and installs stay warm.
+    const needsInstall = hasPlannedChanges || !(0, node_fs_1.existsSync)((0, node_path_1.join)(projectDir, 'node_modules'));
+    if (!needsInstall) {
+        return result;
+    }
+    const installResult = await (0, subprocess_1.runSubprocessCapture)('npm', ['install'], { cwd: projectDir });
+    if (installResult.code !== 0) {
+        // Restore the pre-rewrite package.json before failing. Without this, the retry would see a
+        // manifest that already matches the pins and an existing node_modules (a failed install
+        // doesn't remove it), skip the install, and deploy against the stale installed tree — the
+        // exact skew this sync exists to prevent. Restoring makes the retry recompute the same plan
+        // and re-attempt the install. Best-effort: a restore failure must not mask the install error.
+        if (hasPlannedChanges) {
+            await (0, promises_1.writeFile)(projectPackageJsonPath, projectRaw, 'utf-8').catch(() => undefined);
+        }
+        throw new types_1.DependencySyncError(`npm install failed after updating managed dependencies (exit ${String(installResult.code)}): ${installResult.stderr}`);
+    }
+    result.reinstalled = true;
+    result.notice = (0, messages_1.formatSyncNotice)({
+        migratedFromCaret: result.migratedFromCaret,
+        changes: result.changes,
+        restored: result.restored,
+        reinstalled: result.reinstalled,
+        applied: true,
+    });
+    return result;
+}
+//# sourceMappingURL=sync.js.map

package/dist/lib/dependency-management/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/lib/dependency-management/sync.ts"],"names":[],"mappings":";;AAuDA,0DAkHC;AAzKD,2CAA6E;AAC7E,oDAA2D;AAC3D,yCAMoB;AACpB,iCAAyC;AAEzC,qCAAqC;AACrC,+CAAuD;AACvD,yCAAiC;AAEjC,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,eAAuB;IAEvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,2BAAmB,CAAC,kBAAkB,eAAe,OAAO,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,2BAAmB,CAAC,mBAAmB,eAAe,OAAO,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACI,KAAK,UAAU,uBAAuB,CAAC,OAAuC;IACnF,MAAM,EACJ,qBAAqB,EACrB,UAAU,EACV,QAAQ,GAAG,KAAK,EAChB,IAAI,GAAG,OAAO,EACd,kBAAkB,GAAG,KAAK,EAC1B,cAAc,GAAG,sCAA2B,GAC7C,GAAG,OAAO,CAAC;IACZ,MAAM,SAAS,GAAG,IAAI,KAAK,OAAO,CAAC;IACnC,MAAM,sBAAsB,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAEhE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;IACtG,mFAAmF;IACnF,iFAAiF;IACjF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,CAC/D,sBAAsB,EACtB,gCAAgC,CACjC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,sBAAe,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9C,sFAAsF;IACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,MAAM,MAAM,GAAyB;QACnC,OAAO;QACP,QAAQ,EAAE,QAAQ;QAClB,SAAS;QACT,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,+BAAoB,CAAC;QAChD,MAAM,EAAE,IAAI;KACb,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,6BAAqB,CAAC,IAAA,gCAAqB,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,4BAAiB,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAE9E,IAAI,SAAS,EAAE,CAAC;QACd,qFAAqF;QACrF,MAAM,CAAC,MAAM,GAAG,IAAA,2BAAgB,EAAC;YAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,KAAK;YAClB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,oFAAoF;QACpF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,oBAAS,EAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAmB,CAAC,oDAAoD,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,wFAAwF;IACxF,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,YAAY,GAAG,iBAAiB,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,IAAA,iCAAoB,EAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,2FAA2F;QAC3F,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAA,oBAAS,EAAC,sBAAsB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,2BAAmB,CAC3B,gEAAgE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,CACvH,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAE1B,MAAM,CAAC,MAAM,GAAG,IAAA,2BAAgB,EAAC;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}