@aws/nx-plugin 1.0.0-rc.32 → 1.0.0-rc.33

package/src/preset/generator.js

@@ -119,8 +119,9 @@ const setUpGitSecrets = (tree)=>{
         'husky'
     ]));
 };
-export const presetGenerator = async (tree, { iac, gitSecrets, mcp, containers, preferInstallDependencies })=>{
+export const presetGenerator = async (tree, { iac, gitSecrets, mcp, containers, module, preferInstallDependencies })=>{
     const resolvedContainers = !containers || containers === 'infer' ? inferContainers() : containers;
+    const esm = (module ?? 'esm') === 'esm';
     if (isAmazonian() && !process.env.VITEST && !process.env.CI && process.env.NX_DRY_RUN !== 'true' && process.env.NX_INTERACTIVE !== 'false') {
         const { engagementId } = await enquirer.prompt([
             {
@@ -178,7 +179,9 @@ export const presetGenerator = async (tree, { iac, gitSecrets, mcp, containers,
     });
     updateJson(tree, 'package.json', (packageJson)=>({
             ...packageJson,
-            type: 'module',
+            // Written explicitly so later generators can infer the workspace's module
+            // format from the root `type`.
+            type: esm ? 'module' : 'commonjs',
             scripts: {
                 ...packageJson.scripts,
                 dev: 'nx run-many --target dev',

package/src/preset/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/preset/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { execSync } from 'child_process';\nimport enquirer from 'enquirer';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from '../utils/config/utils';\nimport { inferContainers } from '../utils/containers';\nimport { DEFAULT_BIOME_CONFIG, formatFilesInSubtree } from '../utils/format';\nimport { installDependencies } from '../utils/install';\nimport { configureMcpServers } from '../utils/mcp';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { getNpmScope } from '../utils/npm-scope';\nimport { getGeneratorInfo, type NxGeneratorInfo } from '../utils/nx';\nimport { getPackageManagerDisplayCommands } from '../utils/pkg-manager';\nimport { withVersions } from '../utils/versions';\nimport type { PresetGeneratorSchema } from './schema';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nconst PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\nexport const PRESET_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    tree.write(\n      'pnpm-workspace.yaml',\n      yaml.dump(\n        {\n          packages: WORKSPACES,\n          allowBuilds: Object.fromEntries(\n            PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true]),\n          ),\n          onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        },\n        { quotingType: \"'\" },\n      ),\n    );\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      json.workspaces = WORKSPACES;\n      return json;\n    });\n  }\n};\n\n/**\n * Determines if the current user is an Amazon employee based on their git configuration.\n *\n * This function checks the git user email configuration to identify Amazon employees\n * by looking for email addresses with Amazon domains (e.g., @amazon.com, @amazon.co.uk).\n *\n * @returns {boolean} True if the user's git email has an Amazon domain, false otherwise\n *\n * @example\n * // Returns true for Amazon employee emails\n * // git config user.email = \"john.doe@amazon.com\"\n * isAmazonian(); // true\n *\n * @example\n * // Returns false for non-Amazon emails\n * // git config user.email = \"user@example.com\"\n * isAmazonian(); // false\n *\n * @example\n * // Returns false when git config is not available or throws an error\n * isAmazonian(); // false\n */\nexport function isAmazonian(): boolean {\n  try {\n    // Execute git command to retrieve the user's configured email address\n    const gitEmail = execSync('git config user.email', {\n      encoding: 'utf8',\n    }).trim();\n\n    // Return false if no email is configured\n    if (!gitEmail) {\n      return false;\n    }\n\n    // Split email address to extract domain part\n    const emailParts = gitEmail.split('@');\n    if (emailParts.length < 2) {\n      return false;\n    }\n\n    // Extract domain and normalize to lowercase for comparison\n    const domain = emailParts[1].toLowerCase();\n\n    // Check if domain starts with 'amazon.' (covers amazon.com, amazon.co.uk, etc.)\n    return domain.startsWith('amazon.');\n  } catch (error) {\n    // Return false if git command fails or any other error occurs\n    // This handles cases where git is not installed or configured\n    return false;\n  }\n}\n\nconst setUpGitSecrets = (tree: Tree) => {\n  const gitSecretsDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'git-secrets-dir',\n  );\n  const huskyDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'husky-dir',\n  );\n\n  tree.write(\n    '.git-secrets/git-secrets',\n    readFileSync(joinPathFragments(gitSecretsDir, 'git-secrets'), 'utf-8'),\n  );\n  tree.write(\n    '.husky/pre-commit',\n    readFileSync(joinPathFragments(huskyDir, 'pre-commit'), 'utf-8'),\n  );\n  tree.write('.gitallowed', '\\\\.git-secrets/git-secrets:\\n');\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    scripts: {\n      ...json.scripts,\n      prepare: 'husky',\n    },\n  }));\n\n  addDependenciesToPackageJson(tree, {}, withVersions(['husky']));\n};\n\nexport const presetGenerator = async (\n  tree: Tree,\n  {\n    iac,\n    gitSecrets,\n    mcp,\n    containers,\n    preferInstallDependencies,\n  }: PresetGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n  if (\n    isAmazonian() &&\n    !process.env.VITEST &&\n    !process.env.CI &&\n    process.env.NX_DRY_RUN !== 'true' &&\n    process.env.NX_INTERACTIVE !== 'false'\n  ) {\n    const { engagementId } = await enquirer.prompt<{ engagementId?: string }>([\n      {\n        name: 'engagementId',\n        message: 'Please enter your engagementId (if known)',\n        type: 'input',\n        initial: 'None',\n      },\n    ]);\n\n    if (engagementId != 'None') {\n      await ensureAwsNxPluginConfig(tree);\n      await updateAwsNxPluginConfig(tree, { tags: [engagementId] });\n    }\n  }\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  tree.delete('apps/.gitkeep');\n  tree.delete('libs/.gitkeep');\n  tree.write('packages/.gitkeep', '');\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    analytics: false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: {\n        ...nxJson.targetDefaults?.compile,\n        syncGenerators: [\n          ...(nxJson.targetDefaults?.compile?.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      },\n    },\n  });\n\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    type: 'module',\n    scripts: {\n      ...packageJson.scripts,\n      dev: 'nx run-many --target dev',\n      build: 'nx run-many --target build',\n      lint: 'nx run-many --target lint --configuration=fix',\n      test: 'nx run-many --target test --all',\n      'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n      'build:all': 'nx run-many --target build --all',\n      'affected:all': 'nx affected --target build',\n    },\n  }));\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      '@nx/workspace': readModulePackageJson('@nx/js').packageJson.version,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  if (gitSecrets !== false) {\n    setUpGitSecrets(tree);\n  }\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default presetGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","execSync","enquirer","readFileSync","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","formatFilesInSubtree","installDependencies","configureMcpServers","getNpmScope","getGeneratorInfo","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","PRESET_GENERATOR_INFO","filename","setUpWorkspaces","tree","write","dump","packages","allowBuilds","Object","fromEntries","map","dep","onlyBuiltDependencies","quotingType","json","workspaces","isAmazonian","gitEmail","encoding","trim","emailParts","split","length","domain","toLowerCase","startsWith","error","setUpGitSecrets","gitSecretsDir","dirname","huskyDir","scripts","prepare","presetGenerator","iac","gitSecrets","mcp","containers","preferInstallDependencies","resolvedContainers","process","env","VITEST","CI","NX_DRY_RUN","NX_INTERACTIVE","engagementId","prompt","name","message","initial","tags","provider","engine","formatter","addTsPlugin","delete","nxJson","analytics","targetDefaults","compile","syncGenerators","filter","g","includes","packageJson","dev","build","lint","test","version","exists","JSON","stringify","projectName","generators","entries","_","v","k","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy","Overwrite","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,OAAOC,cAAc,WAAW;AAChC,SAASC,YAAY,QAAQ,KAAK;AAClC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,2BAAwB;AAC/B,SAASC,eAAe,QAAQ,yBAAsB;AACtD,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,qBAAkB;AAC7E,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,mBAAmB,QAAQ,kBAAe;AAEnD,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,gBAAgB,QAA8B,iBAAc;AACrE,SAASC,gCAAgC,QAAQ,0BAAuB;AACxE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ;AAEvE,OAAO,MAAMC,wBAAyCN,iBACpD,YAAYO,QAAQ,EACpB;AAEF,MAAMC,kBAAkB,CAACC;IACvB,IAAIlC,2BAA2B,QAAQ;QACrCkC,KAAKC,KAAK,CACR,uBACAxB,KAAKyB,IAAI,CACP;YACEC,UAAUT;YACVU,aAAaC,OAAOC,WAAW,CAC7BV,wBAAwBW,GAAG,CAAC,CAACC,MAAQ;oBAACA;oBAAK;iBAAK;YAElDC,uBAAuBb;QACzB,GACA;YAAEc,aAAa;QAAI;IAGzB,OAAO;QACLvC,WAAW6B,MAAM,gBAAgB,CAACW;YAChCA,KAAKC,UAAU,GAAGlB;YAClB,OAAOiB;QACT;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASE;IACd,IAAI;QACF,sEAAsE;QACtE,MAAMC,WAAWxC,SAAS,yBAAyB;YACjDyC,UAAU;QACZ,GAAGC,IAAI;QAEP,yCAAyC;QACzC,IAAI,CAACF,UAAU;YACb,OAAO;QACT;QAEA,6CAA6C;QAC7C,MAAMG,aAAaH,SAASI,KAAK,CAAC;QAClC,IAAID,WAAWE,MAAM,GAAG,GAAG;YACzB,OAAO;QACT;QAEA,2DAA2D;QAC3D,MAAMC,SAASH,UAAU,CAAC,EAAE,CAACI,WAAW;QAExC,gFAAgF;QAChF,OAAOD,OAAOE,UAAU,CAAC;IAC3B,EAAE,OAAOC,OAAO;QACd,8DAA8D;QAC9D,8DAA8D;QAC9D,OAAO;IACT;AACF;AAEA,MAAMC,kBAAkB,CAACxB;IACvB,MAAMyB,gBAAgBzD,kBACpB,YAAY0D,OAAO,EACnB,qBACA;IAEF,MAAMC,WAAW3D,kBACf,YAAY0D,OAAO,EACnB,qBACA;IAGF1B,KAAKC,KAAK,CACR,4BACAzB,aAAaR,kBAAkByD,eAAe,gBAAgB;IAEhEzB,KAAKC,KAAK,CACR,qBACAzB,aAAaR,kBAAkB2D,UAAU,eAAe;IAE1D3B,KAAKC,KAAK,CAAC,eAAe;IAE1B9B,WAAW6B,MAAM,gBAAgB,CAACW,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPiB,SAAS;gBACP,GAAGjB,KAAKiB,OAAO;gBACfC,SAAS;YACX;QACF,CAAA;IAEAhE,6BAA6BmC,MAAM,CAAC,GAAGP,aAAa;QAAC;KAAQ;AAC/D;AAEA,OAAO,MAAMqC,kBAAkB,OAC7B9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,UAAU,EACVC,yBAAyB,EACH;IAExB,MAAMC,qBACJ,CAACF,cAAcA,eAAe,UAAUjD,oBAAoBiD;IAC9D,IACErB,iBACA,CAACwB,QAAQC,GAAG,CAACC,MAAM,IACnB,CAACF,QAAQC,GAAG,CAACE,EAAE,IACfH,QAAQC,GAAG,CAACG,UAAU,KAAK,UAC3BJ,QAAQC,GAAG,CAACI,cAAc,KAAK,SAC/B;QACA,MAAM,EAAEC,YAAY,EAAE,GAAG,MAAMpE,SAASqE,MAAM,CAA4B;YACxE;gBACEC,MAAM;gBACNC,SAAS;gBACTlE,MAAM;gBACNmE,SAAS;YACX;SACD;QAED,IAAIJ,gBAAgB,QAAQ;YAC1B,MAAM5D,wBAAwBiB;YAC9B,MAAMhB,wBAAwBgB,MAAM;gBAAEgD,MAAM;oBAACL;iBAAa;YAAC;QAC7D;IACF;IAEA,2DAA2D;IAC3D,MAAM5D,wBAAwBiB;IAC9B,MAAMhB,wBAAwBgB,MAAM;QAClC+B,KAAK;YAAEkB,UAAUlB;QAAI;QACrBG,YAAY;YAAEgB,QAAQd;QAAmB;IAC3C;IAEA,MAAM/D,cAAc2B,MAAM;QACxBmD,WAAW;QACXC,aAAa;IACf;IAEApD,KAAKqD,MAAM,CAAC;IACZrD,KAAKqD,MAAM,CAAC;IACZrD,KAAKC,KAAK,CAAC,qBAAqB;IAEhCF,gBAAgBC;IAEhB,MAAMsD,SAASpF,WAAW8B;IAC1B5B,aAAa4B,MAAM;QACjB,GAAGsD,MAAM;QACTC,WAAW;QACXC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS;gBACP,GAAGH,OAAOE,cAAc,EAAEC,OAAO;gBACjCC,gBAAgB;uBACX,AAACJ,CAAAA,OAAOE,cAAc,EAAEC,SAASC,kBAAkB,EAAE,AAAD,EAAGC,MAAM,CAC9D,CAACC,IACC,CAAC;4BAAC9E;4BAAwBa;yBAA6B,CAACkE,QAAQ,CAC9DD;oBAGNjE;oBACAb;iBACD;YACH;QACF;IACF;IAEAX,WAAW6B,MAAM,gBAAgB,CAAC8D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACdlF,MAAM;YACNgD,SAAS;gBACP,GAAGkC,YAAYlC,OAAO;gBACtBmC,KAAK;gBACLC,OAAO;gBACPC,MAAM;gBACNC,MAAM;gBACN,mBAAmB;gBACnB,aAAa;gBACb,gBAAgB;YAClB;QACF,CAAA;IAEArG,6BACEmC,MACA,CAAC,GACD;QACE,iBAAiBtB,sBAAsB,UAAUoF,WAAW,CAACK,OAAO;QACpE,GAAG1E,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACO,KAAKoE,MAAM,CAAC,eAAe;QAC9BpE,KAAKC,KAAK,CAAC,cAAcoE,KAAKC,SAAS,CAACpF,sBAAsB,MAAM;IACtE;IAEAnB,cACEiC,MACAhC,kBAAkB,YAAY0D,OAAO,EAAE,UACvC,KACA;QACE6C,aAAajF,YAAYU;QACzBwE,YAAYnE,OAAOoE,OAAO,CAAC9F,eAAe6F,UAAU,EACjDb,MAAM,CAAC,CAAC,CAACe,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BpE,GAAG,CAAC,CAAC,CAACqE,GAAGD,EAAE,GAAM,CAAA;gBAAE9B,MAAM+B;gBAAGC,aAAaF,EAAEE,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOtF;YACb,OAAO;gBACLuF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmBnH,kBAAkBoH,SAAS;IAChD;IAGF,IAAIrD,eAAe,OAAO;QACxBR,gBAAgBxB;IAClB;IAEA,IAAIiC,QAAQ,OAAO;QACjB5C,oBAAoBW;IACtB;IAEA,MAAMb,qBAAqBa;IAC3B,OAAO,IACLZ,oBAAoBY,MAAMmC,2BAA2B;YACnDmD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAexD,gBAAgB"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/preset/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { execSync } from 'child_process';\nimport enquirer from 'enquirer';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from '../utils/config/utils';\nimport { inferContainers } from '../utils/containers';\nimport { DEFAULT_BIOME_CONFIG, formatFilesInSubtree } from '../utils/format';\nimport { installDependencies } from '../utils/install';\nimport { configureMcpServers } from '../utils/mcp';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { getNpmScope } from '../utils/npm-scope';\nimport { getGeneratorInfo, type NxGeneratorInfo } from '../utils/nx';\nimport { getPackageManagerDisplayCommands } from '../utils/pkg-manager';\nimport { withVersions } from '../utils/versions';\nimport type { PresetGeneratorSchema } from './schema';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nconst PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\nexport const PRESET_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    tree.write(\n      'pnpm-workspace.yaml',\n      yaml.dump(\n        {\n          packages: WORKSPACES,\n          allowBuilds: Object.fromEntries(\n            PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true]),\n          ),\n          onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        },\n        { quotingType: \"'\" },\n      ),\n    );\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      json.workspaces = WORKSPACES;\n      return json;\n    });\n  }\n};\n\n/**\n * Determines if the current user is an Amazon employee based on their git configuration.\n *\n * This function checks the git user email configuration to identify Amazon employees\n * by looking for email addresses with Amazon domains (e.g., @amazon.com, @amazon.co.uk).\n *\n * @returns {boolean} True if the user's git email has an Amazon domain, false otherwise\n *\n * @example\n * // Returns true for Amazon employee emails\n * // git config user.email = \"john.doe@amazon.com\"\n * isAmazonian(); // true\n *\n * @example\n * // Returns false for non-Amazon emails\n * // git config user.email = \"user@example.com\"\n * isAmazonian(); // false\n *\n * @example\n * // Returns false when git config is not available or throws an error\n * isAmazonian(); // false\n */\nexport function isAmazonian(): boolean {\n  try {\n    // Execute git command to retrieve the user's configured email address\n    const gitEmail = execSync('git config user.email', {\n      encoding: 'utf8',\n    }).trim();\n\n    // Return false if no email is configured\n    if (!gitEmail) {\n      return false;\n    }\n\n    // Split email address to extract domain part\n    const emailParts = gitEmail.split('@');\n    if (emailParts.length < 2) {\n      return false;\n    }\n\n    // Extract domain and normalize to lowercase for comparison\n    const domain = emailParts[1].toLowerCase();\n\n    // Check if domain starts with 'amazon.' (covers amazon.com, amazon.co.uk, etc.)\n    return domain.startsWith('amazon.');\n  } catch (error) {\n    // Return false if git command fails or any other error occurs\n    // This handles cases where git is not installed or configured\n    return false;\n  }\n}\n\nconst setUpGitSecrets = (tree: Tree) => {\n  const gitSecretsDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'git-secrets-dir',\n  );\n  const huskyDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'husky-dir',\n  );\n\n  tree.write(\n    '.git-secrets/git-secrets',\n    readFileSync(joinPathFragments(gitSecretsDir, 'git-secrets'), 'utf-8'),\n  );\n  tree.write(\n    '.husky/pre-commit',\n    readFileSync(joinPathFragments(huskyDir, 'pre-commit'), 'utf-8'),\n  );\n  tree.write('.gitallowed', '\\\\.git-secrets/git-secrets:\\n');\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    scripts: {\n      ...json.scripts,\n      prepare: 'husky',\n    },\n  }));\n\n  addDependenciesToPackageJson(tree, {}, withVersions(['husky']));\n};\n\nexport const presetGenerator = async (\n  tree: Tree,\n  {\n    iac,\n    gitSecrets,\n    mcp,\n    containers,\n    module,\n    preferInstallDependencies,\n  }: PresetGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n  const esm = (module ?? 'esm') === 'esm';\n  if (\n    isAmazonian() &&\n    !process.env.VITEST &&\n    !process.env.CI &&\n    process.env.NX_DRY_RUN !== 'true' &&\n    process.env.NX_INTERACTIVE !== 'false'\n  ) {\n    const { engagementId } = await enquirer.prompt<{ engagementId?: string }>([\n      {\n        name: 'engagementId',\n        message: 'Please enter your engagementId (if known)',\n        type: 'input',\n        initial: 'None',\n      },\n    ]);\n\n    if (engagementId != 'None') {\n      await ensureAwsNxPluginConfig(tree);\n      await updateAwsNxPluginConfig(tree, { tags: [engagementId] });\n    }\n  }\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  tree.delete('apps/.gitkeep');\n  tree.delete('libs/.gitkeep');\n  tree.write('packages/.gitkeep', '');\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    analytics: false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: {\n        ...nxJson.targetDefaults?.compile,\n        syncGenerators: [\n          ...(nxJson.targetDefaults?.compile?.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      },\n    },\n  });\n\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    // Written explicitly so later generators can infer the workspace's module\n    // format from the root `type`.\n    type: esm ? 'module' : 'commonjs',\n    scripts: {\n      ...packageJson.scripts,\n      dev: 'nx run-many --target dev',\n      build: 'nx run-many --target build',\n      lint: 'nx run-many --target lint --configuration=fix',\n      test: 'nx run-many --target test --all',\n      'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n      'build:all': 'nx run-many --target build --all',\n      'affected:all': 'nx affected --target build',\n    },\n  }));\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      '@nx/workspace': readModulePackageJson('@nx/js').packageJson.version,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  if (gitSecrets !== false) {\n    setUpGitSecrets(tree);\n  }\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default presetGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","execSync","enquirer","readFileSync","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","formatFilesInSubtree","installDependencies","configureMcpServers","getNpmScope","getGeneratorInfo","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","PRESET_GENERATOR_INFO","filename","setUpWorkspaces","tree","write","dump","packages","allowBuilds","Object","fromEntries","map","dep","onlyBuiltDependencies","quotingType","json","workspaces","isAmazonian","gitEmail","encoding","trim","emailParts","split","length","domain","toLowerCase","startsWith","error","setUpGitSecrets","gitSecretsDir","dirname","huskyDir","scripts","prepare","presetGenerator","iac","gitSecrets","mcp","containers","module","preferInstallDependencies","resolvedContainers","esm","process","env","VITEST","CI","NX_DRY_RUN","NX_INTERACTIVE","engagementId","prompt","name","message","initial","tags","provider","engine","formatter","addTsPlugin","delete","nxJson","analytics","targetDefaults","compile","syncGenerators","filter","g","includes","packageJson","dev","build","lint","test","version","exists","JSON","stringify","projectName","generators","entries","_","v","k","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy","Overwrite","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,OAAOC,cAAc,WAAW;AAChC,SAASC,YAAY,QAAQ,KAAK;AAClC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,2BAAwB;AAC/B,SAASC,eAAe,QAAQ,yBAAsB;AACtD,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,qBAAkB;AAC7E,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,mBAAmB,QAAQ,kBAAe;AAEnD,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,gBAAgB,QAA8B,iBAAc;AACrE,SAASC,gCAAgC,QAAQ,0BAAuB;AACxE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ;AAEvE,OAAO,MAAMC,wBAAyCN,iBACpD,YAAYO,QAAQ,EACpB;AAEF,MAAMC,kBAAkB,CAACC;IACvB,IAAIlC,2BAA2B,QAAQ;QACrCkC,KAAKC,KAAK,CACR,uBACAxB,KAAKyB,IAAI,CACP;YACEC,UAAUT;YACVU,aAAaC,OAAOC,WAAW,CAC7BV,wBAAwBW,GAAG,CAAC,CAACC,MAAQ;oBAACA;oBAAK;iBAAK;YAElDC,uBAAuBb;QACzB,GACA;YAAEc,aAAa;QAAI;IAGzB,OAAO;QACLvC,WAAW6B,MAAM,gBAAgB,CAACW;YAChCA,KAAKC,UAAU,GAAGlB;YAClB,OAAOiB;QACT;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASE;IACd,IAAI;QACF,sEAAsE;QACtE,MAAMC,WAAWxC,SAAS,yBAAyB;YACjDyC,UAAU;QACZ,GAAGC,IAAI;QAEP,yCAAyC;QACzC,IAAI,CAACF,UAAU;YACb,OAAO;QACT;QAEA,6CAA6C;QAC7C,MAAMG,aAAaH,SAASI,KAAK,CAAC;QAClC,IAAID,WAAWE,MAAM,GAAG,GAAG;YACzB,OAAO;QACT;QAEA,2DAA2D;QAC3D,MAAMC,SAASH,UAAU,CAAC,EAAE,CAACI,WAAW;QAExC,gFAAgF;QAChF,OAAOD,OAAOE,UAAU,CAAC;IAC3B,EAAE,OAAOC,OAAO;QACd,8DAA8D;QAC9D,8DAA8D;QAC9D,OAAO;IACT;AACF;AAEA,MAAMC,kBAAkB,CAACxB;IACvB,MAAMyB,gBAAgBzD,kBACpB,YAAY0D,OAAO,EACnB,qBACA;IAEF,MAAMC,WAAW3D,kBACf,YAAY0D,OAAO,EACnB,qBACA;IAGF1B,KAAKC,KAAK,CACR,4BACAzB,aAAaR,kBAAkByD,eAAe,gBAAgB;IAEhEzB,KAAKC,KAAK,CACR,qBACAzB,aAAaR,kBAAkB2D,UAAU,eAAe;IAE1D3B,KAAKC,KAAK,CAAC,eAAe;IAE1B9B,WAAW6B,MAAM,gBAAgB,CAACW,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPiB,SAAS;gBACP,GAAGjB,KAAKiB,OAAO;gBACfC,SAAS;YACX;QACF,CAAA;IAEAhE,6BAA6BmC,MAAM,CAAC,GAAGP,aAAa;QAAC;KAAQ;AAC/D;AAEA,OAAO,MAAMqC,kBAAkB,OAC7B9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,UAAU,EACVC,MAAM,EACNC,yBAAyB,EACH;IAExB,MAAMC,qBACJ,CAACH,cAAcA,eAAe,UAAUjD,oBAAoBiD;IAC9D,MAAMI,MAAM,AAACH,CAAAA,UAAU,KAAI,MAAO;IAClC,IACEtB,iBACA,CAAC0B,QAAQC,GAAG,CAACC,MAAM,IACnB,CAACF,QAAQC,GAAG,CAACE,EAAE,IACfH,QAAQC,GAAG,CAACG,UAAU,KAAK,UAC3BJ,QAAQC,GAAG,CAACI,cAAc,KAAK,SAC/B;QACA,MAAM,EAAEC,YAAY,EAAE,GAAG,MAAMtE,SAASuE,MAAM,CAA4B;YACxE;gBACEC,MAAM;gBACNC,SAAS;gBACTpE,MAAM;gBACNqE,SAAS;YACX;SACD;QAED,IAAIJ,gBAAgB,QAAQ;YAC1B,MAAM9D,wBAAwBiB;YAC9B,MAAMhB,wBAAwBgB,MAAM;gBAAEkD,MAAM;oBAACL;iBAAa;YAAC;QAC7D;IACF;IAEA,2DAA2D;IAC3D,MAAM9D,wBAAwBiB;IAC9B,MAAMhB,wBAAwBgB,MAAM;QAClC+B,KAAK;YAAEoB,UAAUpB;QAAI;QACrBG,YAAY;YAAEkB,QAAQf;QAAmB;IAC3C;IAEA,MAAMhE,cAAc2B,MAAM;QACxBqD,WAAW;QACXC,aAAa;IACf;IAEAtD,KAAKuD,MAAM,CAAC;IACZvD,KAAKuD,MAAM,CAAC;IACZvD,KAAKC,KAAK,CAAC,qBAAqB;IAEhCF,gBAAgBC;IAEhB,MAAMwD,SAAStF,WAAW8B;IAC1B5B,aAAa4B,MAAM;QACjB,GAAGwD,MAAM;QACTC,WAAW;QACXC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS;gBACP,GAAGH,OAAOE,cAAc,EAAEC,OAAO;gBACjCC,gBAAgB;uBACX,AAACJ,CAAAA,OAAOE,cAAc,EAAEC,SAASC,kBAAkB,EAAE,AAAD,EAAGC,MAAM,CAC9D,CAACC,IACC,CAAC;4BAAChF;4BAAwBa;yBAA6B,CAACoE,QAAQ,CAC9DD;oBAGNnE;oBACAb;iBACD;YACH;QACF;IACF;IAEAX,WAAW6B,MAAM,gBAAgB,CAACgE,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACd,0EAA0E;YAC1E,+BAA+B;YAC/BpF,MAAM0D,MAAM,WAAW;YACvBV,SAAS;gBACP,GAAGoC,YAAYpC,OAAO;gBACtBqC,KAAK;gBACLC,OAAO;gBACPC,MAAM;gBACNC,MAAM;gBACN,mBAAmB;gBACnB,aAAa;gBACb,gBAAgB;YAClB;QACF,CAAA;IAEAvG,6BACEmC,MACA,CAAC,GACD;QACE,iBAAiBtB,sBAAsB,UAAUsF,WAAW,CAACK,OAAO;QACpE,GAAG5E,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACO,KAAKsE,MAAM,CAAC,eAAe;QAC9BtE,KAAKC,KAAK,CAAC,cAAcsE,KAAKC,SAAS,CAACtF,sBAAsB,MAAM;IACtE;IAEAnB,cACEiC,MACAhC,kBAAkB,YAAY0D,OAAO,EAAE,UACvC,KACA;QACE+C,aAAanF,YAAYU;QACzB0E,YAAYrE,OAAOsE,OAAO,CAAChG,eAAe+F,UAAU,EACjDb,MAAM,CAAC,CAAC,CAACe,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BtE,GAAG,CAAC,CAAC,CAACuE,GAAGD,EAAE,GAAM,CAAA;gBAAE9B,MAAM+B;gBAAGC,aAAaF,EAAEE,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOxF;YACb,OAAO;gBACLyF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmBrH,kBAAkBsH,SAAS;IAChD;IAGF,IAAIvD,eAAe,OAAO;QACxBR,gBAAgBxB;IAClB;IAEA,IAAIiC,QAAQ,OAAO;QACjB5C,oBAAoBW;IACtB;IAEA,MAAMb,qBAAqBa;IAC3B,OAAO,IACLZ,oBAAoBY,MAAMoC,2BAA2B;YACnDoD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAe1D,gBAAgB"}

package/src/preset/schema.d.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/preset/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Containers } from '../utils/containers';\nimport { Iac } from '../utils/iac';\n\nexport type PresetContainersOption = Containers | 'infer';\n\nexport interface PresetGeneratorSchema {\n  readonly iac: Iac;\n  readonly gitSecrets?: boolean;\n  readonly mcp?: boolean;\n  readonly containers?: PresetContainersOption;\n  readonly preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAOD,WAMC"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/preset/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport { Containers } from '../utils/containers';\nimport { Iac } from '../utils/iac';\nimport type { ModuleFormat } from '../utils/module-format';\n\nexport type PresetContainersOption = Containers | 'infer';\n\nexport interface PresetGeneratorSchema {\n  readonly iac: Iac;\n  readonly gitSecrets?: boolean;\n  readonly mcp?: boolean;\n  readonly containers?: PresetContainersOption;\n  readonly module?: ModuleFormat;\n  readonly preferInstallDependencies?: boolean;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAQD,WAOC"}

package/src/preset/schema.d.ts

@@ -5,6 +5,7 @@
 
 import { Containers } from '../utils/containers';
 import { Iac } from '../utils/iac';
+import type { ModuleFormat } from '../utils/module-format';
 
 export type PresetContainersOption = Containers | 'infer';
 
@@ -13,5 +14,6 @@ export interface PresetGeneratorSchema {
   readonly gitSecrets?: boolean;
   readonly mcp?: boolean;
   readonly containers?: PresetContainersOption;
+  readonly module?: ModuleFormat;
   readonly preferInstallDependencies?: boolean;
 }

package/src/preset/schema.json

@@ -31,6 +31,12 @@
       "x-priority": "important",
       "x-prompt": "Which container engine would you like to use? (default: infer)"
     },
+    "module": {
+      "type": "string",
+      "description": "Module format for generated TypeScript code and configuration.",
+      "enum": ["esm", "cjs"],
+      "default": "esm"
+    },
     "preferInstallDependencies": {
       "type": "boolean",
       "description": "Whether to prefer installing dependencies after the generator runs. Set to false to defer installing when batching multiple generators (an install still runs if needed so subsequent generators can compute the Nx project graph); install once at the end.",

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -283,17 +283,17 @@ dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.31.0",
   "aws-opentelemetry-distro==0.18.0",
-  "bedrock-agentcore==1.15.1",
-  "boto3==1.43.37",
-  "fastapi==0.138.2",
+  "bedrock-agentcore==1.18.0",
+  "boto3==1.43.46",
+  "fastapi==0.139.0",
   "mcp==1.28.1",
-  "strands-agents==1.45.0",
-  "strands-agents-tools==0.8.2",
-  "uvicorn==0.49.0"
+  "strands-agents==1.47.0",
+  "strands-agents-tools==0.8.3",
+  "uvicorn==0.51.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.138.2" ]
+dev = [ "fastapi[standard]==0.139.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -710,20 +710,20 @@ dependencies = [
   "proj-agent-connection",
   "aws-lambda-powertools==3.31.0",
   "aws-opentelemetry-distro==0.18.0",
-  "bedrock-agentcore==1.15.1",
-  "boto3==1.43.37",
-  "fastapi==0.138.2",
+  "bedrock-agentcore==1.18.0",
+  "boto3==1.43.46",
+  "fastapi==0.139.0",
   "mcp==1.28.1",
-  "langchain==1.3.11",
-  "langchain-aws==1.6.1",
-  "langgraph==1.2.7",
+  "langchain==1.3.12",
+  "langchain-aws==1.6.2",
+  "langgraph==1.2.9",
   "ag-ui-protocol==0.1.19",
   "ag-ui-langgraph==0.0.42",
-  "uvicorn==0.49.0"
+  "uvicorn==0.51.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.138.2" ]
+dev = [ "fastapi[standard]==0.139.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -23,6 +23,25 @@ variable "tags" {
   default     = {}
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 variable "appconfig_application_id" {
   description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
   type        = string
@@ -38,6 +57,9 @@ module "agent_core_runtime" {
   agent_runtime_name = "TerraformSnapshotAgent"
   docker_image_tag = "proj-terraform-snapshot-agent:latest"
   server_protocol = "HTTP"
+  enable_vpc = var.enable_vpc
+  vpc_id = var.vpc_id
+  subnet_ids = var.subnet_ids
 
   env = merge({
     RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
@@ -92,6 +114,11 @@ output "appconfig_application_id" {
   description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
   value       = var.appconfig_application_id
 }
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = module.agent_core_runtime.security_group_id
+}
 "
 `;
 
@@ -102,7 +129,7 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -168,6 +195,30 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
@@ -403,6 +454,28 @@ resource "null_resource" "docker_publish" {
   depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
 }
 
+# Security group for the agent core runtime, used when running inside a VPC
+resource "aws_security_group" "agent_core_runtime" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to the runtime via network_configuration; Checkov cannot resolve this reference
+  name_prefix = "\${var.agent_runtime_name}-runtime-"
+  description = "Security group for the \${var.agent_runtime_name} agent core runtime"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "agent_core_runtime_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.agent_core_runtime[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Bedrock AgentCore Agent Runtime
 resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   agent_runtime_name = "\${var.agent_runtime_name}_\${random_id.unique_suffix.hex}"
@@ -429,7 +502,15 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   }
 
   network_configuration {
-    network_mode = "PUBLIC"
+    network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
+
+    dynamic "network_mode_config" {
+      for_each = var.enable_vpc ? [1] : []
+      content {
+        security_groups = [aws_security_group.agent_core_runtime[0].id]
+        subnets         = var.subnet_ids
+      }
+    }
   }
 
   protocol_configuration {
@@ -456,7 +537,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.37 python -c "
+      uv run --with boto3==1.43.46 python -c "
 import boto3
 import json
 import os
@@ -531,5 +612,10 @@ output "agent_runtime_version" {
   description = "Version of the Bedrock Agent Core runtime"
   value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_version
 }
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.agent_core_runtime[0].id : null
+}
 "
 `;

package/src/py/dynamodb/__snapshots__/generator.spec.ts.snap

@@ -35,7 +35,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -192,7 +192,7 @@ exports[`py#dynamodb generator > should generate terraform modules when iac is t
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     random = {
       source  = "hashicorp/random"

package/src/py/fast-api/__snapshots__/generator.terraform.spec.ts.snap

@@ -11,7 +11,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -258,7 +258,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -743,7 +743,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -990,7 +990,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -1547,7 +1547,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -1794,7 +1794,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -2256,7 +2256,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -2512,7 +2512,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -3234,7 +3234,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -3490,7 +3490,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }
@@ -4201,7 +4201,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -4457,7 +4457,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
   }
 }

package/src/py/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -70,7 +70,7 @@ exports[`lambda-handler project generator > terraform iac > should generate terr
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     archive = {
       source  = "hashicorp/archive"
@@ -251,7 +251,7 @@ exports[`lambda-handler project generator > terraform iac > should match snapsho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     archive = {
       source  = "hashicorp/archive"

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -135,7 +135,7 @@ exports[`py#mcp-server generator > should match snapshot for Terraform generated
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.52.0"
+      version = "6.54.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -201,6 +201,30 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
@@ -436,6 +460,28 @@ resource "null_resource" "docker_publish" {
   depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
 }
 
+# Security group for the agent core runtime, used when running inside a VPC
+resource "aws_security_group" "agent_core_runtime" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to the runtime via network_configuration; Checkov cannot resolve this reference
+  name_prefix = "\${var.agent_runtime_name}-runtime-"
+  description = "Security group for the \${var.agent_runtime_name} agent core runtime"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "agent_core_runtime_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.agent_core_runtime[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Bedrock AgentCore Agent Runtime
 resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   agent_runtime_name = "\${var.agent_runtime_name}_\${random_id.unique_suffix.hex}"
@@ -462,7 +508,15 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   }
 
   network_configuration {
-    network_mode = "PUBLIC"
+    network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
+
+    dynamic "network_mode_config" {
+      for_each = var.enable_vpc ? [1] : []
+      content {
+        security_groups = [aws_security_group.agent_core_runtime[0].id]
+        subnets         = var.subnet_ids
+      }
+    }
   }
 
   protocol_configuration {
@@ -489,7 +543,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.37 python -c "
+      uv run --with boto3==1.43.46 python -c "
 import boto3
 import json
 import os
@@ -564,6 +618,11 @@ output "agent_runtime_version" {
   description = "Version of the Bedrock Agent Core runtime"
   value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_version
 }
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.agent_core_runtime[0].id : null
+}
 "
 `;
 
@@ -590,6 +649,25 @@ variable "tags" {
   default     = {}
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 variable "appconfig_application_id" {
   description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
   type        = string
@@ -605,6 +683,9 @@ module "agent_core_runtime" {
   agent_runtime_name = "TerraformSnapshotServer"
   docker_image_tag = "proj-terraform-snapshot-server:latest"
   server_protocol = "MCP"
+  enable_vpc = var.enable_vpc
+  vpc_id = var.vpc_id
+  subnet_ids = var.subnet_ids
 
   env = merge({
     RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
@@ -647,6 +728,11 @@ output "appconfig_application_id" {
   description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
   value       = var.appconfig_application_id
 }
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = module.agent_core_runtime.security_group_id
+}
 "
 `;
 
@@ -718,8 +804,8 @@ version = "0.1.0"
 dependencies = [
   "aws-lambda-powertools==3.31.0",
   "mcp==1.28.1",
-  "uvicorn==0.49.0",
-  "boto3==1.43.37",
+  "uvicorn==0.51.0",
+  "boto3==1.43.46",
   "aws-opentelemetry-distro==0.18.0"
 ]